{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Entity Graph\n",
    "============\n",
    "\n",
    "This notebook demonstrates the use of the MSTICPy entity graph visualization built using the [Bokeh library](https://bokeh.pydata.org) and [NetworkX](https://networkx.org/).\n",
    "\n",
    "You must have msticpy installed:\n",
    "```\n",
    "%pip install --upgrade msticpy\n",
    "```\n",
    "\n",
    "Often when investigating an incident you will want to keep track of the key events and entities that appear in the investigation, along with the key relationships between them. An effective way to do this is to create a graph of the key entities that represents those entities and thier connections.\n",
    "\n",
    "The `EntitiyGraph` feature has been created to allow a user to create a graph of Incidents, Alerts, and other entities during the course of an investigation in order to keep track of an visualize these interactions.\n",
    "A graph can be initially created using either an Alert, Incident, SecurityIncident or other entity type, with additional entities, links between these entities, and notes added as an investigation progresses.\n",
    "As well as creating a graph object this feature allows for the plotting of the graph, allowing for interactive exploration of the entities and their links.\n",
    "\n",
    "<div class=\"alert alert-block alert-info\">\n",
    "<b>Note:</b> This feature provides similar functionality to `msticpy.nbtools.security_alert_graph`, however it is expanded to include support for additional entity types and incidents.\n",
    "You can pass `EntityGraph` a SecurtyAlert in the same way you can with security_alert_graph and will produce a very similar graph.\n",
    "</div>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<hr><h4>Starting Notebook initialization...</h4> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "msticpy version installed: 1.7.0 latest published: 1.7.5<br>A newer version of msticpy - 1.7.5 is available.<br>Upgrade with 'pip install --upgrade msticpy'<br> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Processing imports.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Imported: pd (pandas), IPython.get_ipython, IPython.display.display, IPython.display.HTML, IPython.display.Markdown, widgets (ipywidgets), pathlib.Path, plt (matplotlib.pyplot), matplotlib.MatplotlibDeprecationWarning, np (numpy), sns (seaborn), msticpy, msticpy.data.QueryProvider, msticpy.vis.foliummap.FoliumMap, msticpy.common.utility.md, msticpy.common.utility.md_warn, msticpy.common.wsconfig.WorkspaceConfig, msticpy.init.pivot.Pivot, msticpy.datamodel.entities, msticpy.init.nbmagics, msticpy.vis.mp_pandas_plot, msticpy.init.mp_pandas_accessors <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Checking configuration.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Azure CLI credentials not detected. (see <a href='https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/Caching-credentials-with-Azure-CLI'>Caching credentials with Azure CLI</>) <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Setting notebook options.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       " <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       " <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h4>Notebook initialization complete</h4> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Imports\n",
    "from msticpy.common.utility import check_py_version\n",
    "MIN_REQ_PYTHON = (3,6)\n",
    "check_py_version(MIN_REQ_PYTHON)\n",
    "\n",
    "import pandas as pd\n",
    "\n",
    "from msticpy import init_notebook\n",
    "init_notebook(globals())\n",
    "from msticpy.datamodel.soc.incident import Incident\n",
    "from msticpy.datamodel.entities.alert import Alert\n",
    "from msticpy.datamodel.entities.url import Url\n",
    "from msticpy.nbtools.security_alert import SecurityAlert\n",
    "from msticpy.vis.entity_graph_tools import EntityGraph\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Creating an Incident object to plot"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<h3>incident</h3>{&nbsp;'AdditionalData':&nbsp;{&nbsp;'Alert&nbsp;Count':&nbsp;1,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Bookmarks&nbsp;Count':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Comments&nbsp;Count':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Incident&nbsp;Number':&nbsp;123,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Products':&nbsp;['Azure&nbsp;Sentinel'],<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Related&nbsp;Rule&nbsp;IDs':&nbsp;['123'],<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Tactics':&nbsp;['PrivilegeEscalation']},<br>&nbsp;&nbsp;'Alerts':&nbsp;[&nbsp;Alert(DisplayName=User&nbsp;Added&nbsp;to&nbsp;Priviledged&nbsp;Group&nbsp;in&nbsp;CONTOSO&nbsp;Domain,&nbsp;SystemAlertIds=['...)],<br>&nbsp;&nbsp;'DisplayName':&nbsp;'Sample&nbsp;Incident',<br>&nbsp;&nbsp;'EndTime':&nbsp;'2021-09-22T14:39:24.04Z',<br>&nbsp;&nbsp;'Entities':&nbsp;[&nbsp;Host(DnsDomain=demo.contoso.com,&nbsp;HostName=demo,&nbsp;NetBiosName=demo,&nbsp;OSFamily=OSFamily.W...),<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Account(DisplayName=CONTOSO\\auser,&nbsp;TimeGenerated=2022-04-22&nbsp;01:54:53.619295,&nbsp;Type=accoun...)],<br>&nbsp;&nbsp;'IncidentID':&nbsp;'123',<br>&nbsp;&nbsp;'Labels':&nbsp;[{'labelName':&nbsp;'Tests&nbsp;Label',&nbsp;'labelType':&nbsp;'User'}],<br>&nbsp;&nbsp;'Owner':&nbsp;{&nbsp;'Email':&nbsp;'user@contoso.com',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'ID':&nbsp;'0a70480d-b1cd-4466-9b75-3814e34579eb',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Name':&nbsp;'A&nbsp;User',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'UPN':&nbsp;'user@contoso.com'},<br>&nbsp;&nbsp;'Severity':&nbsp;'Medium',<br>&nbsp;&nbsp;'StartTime':&nbsp;'2021-09-22T14:39:24.04Z',<br>&nbsp;&nbsp;'Status':&nbsp;'Active',<br>&nbsp;&nbsp;'TimeGenerated':&nbsp;'2021-09-22T15:09:09.2786667Z',<br>&nbsp;&nbsp;'Type':&nbsp;'incident'}"
      ],
      "text/plain": [
       "Incident(DisplayName=Sample Incident, IncidentID=123, Severity=Medium, Status=Active, Own...)"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "inc = {\n",
    "    \"id\": \"123\",\n",
    "    \"name\": \"135a072e-77c3-4293-8c9a-7fdd53b5d620\",\n",
    "    \"etag\": '\"d4fce673-dd4b-4d22-a39f-bda55d6079f3\"',\n",
    "    \"type\": \"Microsoft.SecurityInsights/Incidents\",\n",
    "    \"properties.title\": \"Sample Incident\",\n",
    "    \"properties.description\": \"This is a sample incident to support unit tests\",\n",
    "    \"properties.severity\": \"Medium\",\n",
    "    \"properties.status\": \"Active\",\n",
    "    \"properties.owner.objectId\": \"0a70480d-b1cd-4466-9b75-3814e34579eb\",\n",
    "    \"properties.owner.email\": \"user@contoso.com\",\n",
    "    \"properties.owner.assignedTo\": \"A User\",\n",
    "    \"properties.owner.userPrincipalName\": \"user@contoso.com\",\n",
    "    \"properties.labels\": [{\"labelName\": \"Tests Label\", \"labelType\": \"User\"}],\n",
    "    \"properties.firstActivityTimeUtc\": \"2021-09-22T14:39:24.04Z\",\n",
    "    \"properties.lastActivityTimeUtc\": \"2021-09-22T14:39:24.04Z\",\n",
    "    \"properties.lastModifiedTimeUtc\": \"2021-09-22T15:09:34.376619Z\",\n",
    "    \"properties.createdTimeUtc\": \"2021-09-22T15:09:09.2786667Z\",\n",
    "    \"properties.incidentNumber\": 123,\n",
    "    \"properties.additionalData.alertsCount\": 1,\n",
    "    \"properties.additionalData.bookmarksCount\": 0,\n",
    "    \"properties.additionalData.commentsCount\": 0,\n",
    "    \"properties.additionalData.alertProductNames\": [\"Azure Sentinel\"],\n",
    "    \"properties.additionalData.tactics\": [\"PrivilegeEscalation\"],\n",
    "    \"properties.relatedAnalyticRuleIds\": [\"123\"],\n",
    "    \"properties.incidentUrl\": \"https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/\",\n",
    "    \"Entities\": [\n",
    "        (\n",
    "            \"Host\",\n",
    "            {\n",
    "                \"dnsDomain\": \"demo.contoso.com\",\n",
    "                \"hostName\": \"demo\",\n",
    "                \"omsAgentID\": \"ce7903cf-2d8f-47e9-a338-2259f02a9779\",\n",
    "                \"osFamily\": \"Windows\",\n",
    "                \"osVersion\": \"10\",\n",
    "                \"additionalData\": {\n",
    "                    \"DataSource\": \"SecurityEvent\",\n",
    "                    \"AzureResourceId\": \"/subscriptions/ce7903cf-2d8f-47e9-a338-2259f02a9779/resourcegroups/test/providers/microsoft.compute/virtualmachines/demo\",\n",
    "                    \"SubscriptionId\": \"ce7903cf-2d8f-47e9-a338-2259f02a9779\",\n",
    "                    \"ResourceId\": \"/subscriptions/ce7903cf-2d8f-47e9-a338-2259f02a9779/resourceGroups/test/providers/Microsoft.Compute/virtualMachines/demo\",\n",
    "                    \"VMUUID\": \"ce7903cf-2d8f-47e9-a338-2259f02a9779\",\n",
    "                    \"ShouldResolveIp\": \"False\",\n",
    "                },\n",
    "                \"friendlyName\": \"demo\",\n",
    "            },\n",
    "        ),\n",
    "        (\n",
    "            \"Account\",\n",
    "            {\n",
    "                \"accountName\": \"auser\",\n",
    "                \"displayName\": \"CONTOSO\\\\auser\",\n",
    "                \"friendlyName\": \"CONTOSO\\\\auser\",\n",
    "            },\n",
    "        ),\n",
    "    ],\n",
    "    \"Alerts\": [\n",
    "        {\n",
    "            \"ID\": \"8b7d06d8-dbae-4b23-87ed-1a27b75437d5\",\n",
    "            \"Name\": \"User Added to Priviledged Group in CONTOSO Domain\",\n",
    "            \"Entities\": None,\n",
    "        }\n",
    "    ],\n",
    "    \"Type\": \"incident\",\n",
    "}\n",
    "\n",
    "incident = Incident(inc)\n",
    "display(incident)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Basic graph creation and plotting with an Incident\n",
    "Creating a graph is as simple as instantiating an `EntityGraph` object and passing it a incident object.  \n",
    "To display the graph as a visualization can be achieved by calling the `plot` method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1002\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  const force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  const JS_MIME_TYPE = 'application/javascript';\n  const HTML_MIME_TYPE = 'text/html';\n  const EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  const CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    const script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    const cell = handle.cell;\n\n    const id = cell.output_area._bokeh_element_id;\n    const server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      const cmd_clean = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd_clean, {\n        iopub: {\n          output: function(msg) {\n            const id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      const cmd_destroy = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd_destroy);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    const output_area = handle.output_area;\n    const output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    const toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      const bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      const script_attrs = bk_div.children[0].attributes;\n      for (let i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      const toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      const props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    const events = require('base/js/events');\n    const OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  const NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    const el = document.getElementById(\"1002\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  const js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-mathjax-2.4.2.min.js\"];\n  const css_urls = [];\n  \n\n  const inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (let i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      const cell = $(document.getElementById(\"1002\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1003\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  const force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  const JS_MIME_TYPE = 'application/javascript';\n  const HTML_MIME_TYPE = 'text/html';\n  const EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  const CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    const script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    const cell = handle.cell;\n\n    const id = cell.output_area._bokeh_element_id;\n    const server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      const cmd_clean = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd_clean, {\n        iopub: {\n          output: function(msg) {\n            const id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      const cmd_destroy = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd_destroy);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    const output_area = handle.output_area;\n    const output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    const toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      const bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      const script_attrs = bk_div.children[0].attributes;\n      for (let i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      const toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      const props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    const events = require('base/js/events');\n    const OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  const NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    const el = document.getElementById(\"1003\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  const js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-mathjax-2.4.2.min.js\"];\n  const css_urls = [];\n  \n\n  const inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (let i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      const cell = $(document.getElementById(\"1003\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"c34ddf3f-a502-4c10-ac01-627f54d8d1a7\" data-root-id=\"1004\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  const docs_json = {\"9fe2fcca-5d7f-4ff4-9ea6-e55a50f6c16f\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"1015\"}],\"center\":[{\"id\":\"1018\"},{\"id\":\"1022\"},{\"id\":\"1054\"},{\"id\":\"1055\"},{\"id\":\"1056\"},{\"id\":\"1057\"}],\"height\":800,\"left\":[{\"id\":\"1019\"}],\"renderers\":[{\"id\":\"1039\"}],\"title\":{\"id\":\"1005\"},\"toolbar\":{\"id\":\"1030\"},\"width\":800,\"x_range\":{\"id\":\"1007\"},\"x_scale\":{\"id\":\"1011\"},\"y_range\":{\"id\":\"1009\"},\"y_scale\":{\"id\":\"1013\"}},\"id\":\"1004\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{},\"id\":\"1044\",\"type\":\"MultiLine\"},{\"attributes\":{\"graph_layout\":{\"Alert: User Added to Priviledged Group in CONTOSO Domain\":[-1.8582310440728436,0.7808352514028334],\"CONTOSO\\\\auser\":[1.6088006024664065,1.22003818899368],\"Incident: Sample Incident\":[-0.0011425252150169336,-0.0008734403965135709],\"demo\":[0.2505729668214543,-2.0]}},\"id\":\"1048\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1041\"},\"glyph\":{\"id\":\"1049\"},\"group\":null,\"hover_glyph\":null,\"view\":{\"id\":\"1043\"}},\"id\":\"1042\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Incident: Sample Incident\",\"text_font_size\":\"10pt\",\"x\":-0.0011425252150169336,\"x_offset\":5,\"y\":-0.0008734403965135709,\"y_offset\":5},\"id\":\"1054\",\"type\":\"Label\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Alert Entity graph\"},\"id\":\"1005\",\"type\":\"Title\"},{\"attributes\":{\"bottom_units\":\"screen\",\"coordinates\":null,\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"group\":null,\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1029\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"CONTOSO\\\\auser\",\"text_font_size\":\"10pt\",\"x\":1.6088006024664065,\"x_offset\":5,\"y\":1.22003818899368,\"y_offset\":5},\"id\":\"1057\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1074\",\"type\":\"AllLabels\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"demo\",\"CONTOSO\\\\auser\"],\"start\":[\"Incident: Sample Incident\",\"Incident: Sample Incident\",\"Incident: Sample Incident\"]},\"selected\":{\"id\":\"1079\"},\"selection_policy\":{\"id\":\"1078\"}},\"id\":\"1045\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"1076\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"axis\":{\"id\":\"1015\"},\"coordinates\":null,\"group\":null,\"ticker\":null},\"id\":\"1018\",\"type\":\"Grid\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"demo\",\"text_font_size\":\"10pt\",\"x\":0.2505729668214543,\"x_offset\":5,\"y\":-2.0,\"y_offset\":5},\"id\":\"1056\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1027\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"1013\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"1026\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"1028\",\"type\":\"HelpTool\"},{\"attributes\":{\"overlay\":{\"id\":\"1029\"}},\"id\":\"1025\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"1023\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"1068\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"1024\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"source\":{\"id\":\"1041\"}},\"id\":\"1043\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1067\",\"type\":\"NodesOnly\"},{\"attributes\":{\"coordinates\":null,\"edge_renderer\":{\"id\":\"1046\"},\"group\":null,\"inspection_policy\":{\"id\":\"1068\"},\"layout_provider\":{\"id\":\"1048\"},\"node_renderer\":{\"id\":\"1042\"},\"selection_policy\":{\"id\":\"1067\"}},\"id\":\"1039\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"Name\",\"@Name\"],[\"Description\",\"@Description\"],[\"Type\",\"@Type\"]]},\"id\":\"1037\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"1016\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"1020\",\"type\":\"BasicTicker\"},{\"attributes\":{\"axis\":{\"id\":\"1019\"},\"coordinates\":null,\"dimension\":1,\"group\":null,\"ticker\":null},\"id\":\"1022\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"1079\",\"type\":\"Selection\"},{\"attributes\":{\"coordinates\":null,\"formatter\":{\"id\":\"1070\"},\"group\":null,\"major_label_policy\":{\"id\":\"1071\"},\"ticker\":{\"id\":\"1020\"}},\"id\":\"1019\",\"type\":\"LinearAxis\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"1049\",\"type\":\"Circle\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1045\"},\"glyph\":{\"id\":\"1044\"},\"group\":null,\"hover_glyph\":null,\"view\":{\"id\":\"1047\"}},\"id\":\"1046\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1078\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1009\",\"type\":\"Range1d\"},{\"attributes\":{\"source\":{\"id\":\"1045\"}},\"id\":\"1047\",\"type\":\"CDSView\"},{\"attributes\":{\"data\":{\"AdditionalData\":[\"{'Alert Count': 1, 'Bookmarks Count': 0, 'Comments Count': 0, 'Products': ['Azure Sentinel'], 'Tactics': ['PrivilegeEscalation'], 'Related Rule IDs': ['123'], 'Incident Number': 123}\",\"{'ID': '8b7d06d8-dbae-4b23-87ed-1a27b75437d5', 'Name': 'User Added to Priviledged Group in CONTOSO Domain'}\",null,null],\"Description\":[\"2021-09-22T15:09:09.2786667Z - Sample Incident - 123\",null,\"demo.demo.contoso.com (OSFamily.Windows)\",null],\"DisplayName\":[\"Sample Incident\",\"User Added to Priviledged Group in CONTOSO Domain\",null,\"CONTOSO\\\\auser\"],\"DnsDomain\":[null,null,\"demo.contoso.com\",null],\"EndTime\":[\"2021-09-22T14:39:24.04Z\",null,null,null],\"HostName\":[null,null,\"demo\",null],\"IncidentID\":[\"123\",null,null,null],\"Name\":[\"Incident: Sample Incident\",\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"demo\",\"CONTOSO\\\\auser\"],\"NetBiosName\":[null,null,\"demo\",null],\"OSFamily\":[null,null,\"OSFamily.Windows\",null],\"Owner\":[\"{'Name': 'A User', 'Email': 'user@contoso.com', 'UPN': 'user@contoso.com', 'ID': '0a70480d-b1cd-4466-9b75-3814e34579eb'}\",null,null,null],\"Severity\":[\"Medium\",null,null,null],\"StartTime\":[\"2021-09-22T14:39:24.04Z\",null,null,null],\"Status\":[\"Active\",null,null,null],\"TimeGenerated\":[\"2021-09-22T15:09:09.2786667Z\",\"2022-04-22 01:54:53.619295\",\"2022-04-22 01:54:53.619295\",\"2022-04-22 01:54:53.619295\"],\"Type\":[\"incident\",\"alerts\",\"host\",\"account\"],\"index\":[\"Incident: Sample Incident\",\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"demo\",\"CONTOSO\\\\auser\"],\"node_color\":[\"red\",\"orange\",\"green\",\"green\"]},\"selected\":{\"id\":\"1077\"},\"selection_policy\":{\"id\":\"1076\"}},\"id\":\"1041\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"coordinates\":null,\"formatter\":{\"id\":\"1073\"},\"group\":null,\"major_label_policy\":{\"id\":\"1074\"},\"ticker\":{\"id\":\"1016\"}},\"id\":\"1015\",\"type\":\"LinearAxis\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1007\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"1077\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1073\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"text_font_size\":\"10pt\",\"x\":-1.8582310440728436,\"x_offset\":5,\"y\":0.7808352514028334,\"y_offset\":5},\"id\":\"1055\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1071\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"1011\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"1070\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"tools\":[{\"id\":\"1023\"},{\"id\":\"1024\"},{\"id\":\"1025\"},{\"id\":\"1026\"},{\"id\":\"1027\"},{\"id\":\"1028\"},{\"id\":\"1037\"}]},\"id\":\"1030\",\"type\":\"Toolbar\"}],\"root_ids\":[\"1004\"]},\"title\":\"Bokeh Application\",\"version\":\"2.4.2\"}};\n  const render_items = [{\"docid\":\"9fe2fcca-5d7f-4ff4-9ea6-e55a50f6c16f\",\"root_ids\":[\"1004\"],\"roots\":{\"1004\":\"c34ddf3f-a502-4c10-ac01-627f54d8d1a7\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    let attempts = 0;\n    const timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1004"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'1004', <span id=\"1203\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='1015', ...)],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='1018', ...), Grid(id='1022', ...), Label(id='1054', ...), Label(id='1055', ...), Label(id='1056', ...), Label(id='1057', ...)],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_scales&nbsp;=&nbsp;{},</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_scales&nbsp;=&nbsp;{},</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='1019', ...)],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='1039', ...)],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='1005', ...),</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='1030', ...),</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='1007', ...),</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='1011', ...),</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='1009', ...),</div></div><div class=\"1202\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='1013', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  let expanded = false;\n",
       "  const ellipsis = document.getElementById(\"1203\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    const rows = document.getElementsByClassName(\"1202\");\n",
       "    for (let i = 0; i < rows.length; i++) {\n",
       "      const el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='1004', ...)"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "graph = EntityGraph(incident)\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As you can see above this has displayed a visualization that shows the incident, the alert associated with that incident and the entities associated with the incident.\n",
    "\n",
    "The same can be achieved by passing in an Alert or SecurityAlert entity:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1205\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  const force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  const JS_MIME_TYPE = 'application/javascript';\n  const HTML_MIME_TYPE = 'text/html';\n  const EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  const CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    const script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    const cell = handle.cell;\n\n    const id = cell.output_area._bokeh_element_id;\n    const server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      const cmd_clean = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd_clean, {\n        iopub: {\n          output: function(msg) {\n            const id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      const cmd_destroy = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd_destroy);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    const output_area = handle.output_area;\n    const output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    const toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      const bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      const script_attrs = bk_div.children[0].attributes;\n      for (let i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      const toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      const props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    const events = require('base/js/events');\n    const OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  const NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    const el = document.getElementById(\"1205\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  const js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-mathjax-2.4.2.min.js\"];\n  const css_urls = [];\n  \n\n  const inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (let i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      const cell = $(document.getElementById(\"1205\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "ename": "ValueError",
     "evalue": "None cannot be a node",
     "output_type": "error",
     "traceback": [
      "\u001b[1;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[1;31mValueError\u001b[0m                                Traceback (most recent call last)",
      "\u001b[1;32m~\\AppData\\Local\\Temp\\ipykernel_66244\\1263983688.py\u001b[0m in \u001b[0;36m<module>\u001b[1;34m\u001b[0m\n\u001b[0;32m     53\u001b[0m \u001b[0malert\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mAlert\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0msample_alert\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m     54\u001b[0m \u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m---> 55\u001b[1;33m \u001b[0mgraph\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mEntityGraph\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0malert\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m     56\u001b[0m \u001b[0mgraph\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mplot\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;32me:\\src\\msticpy\\msticpy\\vis\\entity_graph_tools.py\u001b[0m in \u001b[0;36m__init__\u001b[1;34m(self, entity)\u001b[0m\n\u001b[0;32m     54\u001b[0m         \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0malertentity_graph\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mnx\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mGraph\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mid\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;34m\"IncidentGraph\"\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m     55\u001b[0m         \u001b[1;32mif\u001b[0m \u001b[0misinstance\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mentity\u001b[0m\u001b[1;33m,\u001b[0m \u001b[1;33m(\u001b[0m\u001b[0mIncident\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mAlert\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m---> 56\u001b[1;33m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_add_incident_or_alert_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mentity\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m     57\u001b[0m         \u001b[1;32melif\u001b[0m \u001b[0misinstance\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mentity\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mpd\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mDataFrame\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m     58\u001b[0m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0madd_incident\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mentity\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;32me:\\src\\msticpy\\msticpy\\vis\\entity_graph_tools.py\u001b[0m in \u001b[0;36m_add_incident_or_alert_node\u001b[1;34m(self, incident)\u001b[0m\n\u001b[0;32m    352\u001b[0m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_add_incident_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mincident\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    353\u001b[0m         \u001b[1;32melif\u001b[0m \u001b[0misinstance\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mincident\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mAlert\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m--> 354\u001b[1;33m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_add_alert_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mincident\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    355\u001b[0m \u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    356\u001b[0m     \u001b[1;32mdef\u001b[0m \u001b[0m_add_entity_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mself\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0ment\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mattached_to\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;32mNone\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;32me:\\src\\msticpy\\msticpy\\vis\\entity_graph_tools.py\u001b[0m in \u001b[0;36m_add_alert_node\u001b[1;34m(self, alert, incident_name)\u001b[0m\n\u001b[0;32m    365\u001b[0m         \u001b[1;32mif\u001b[0m \u001b[0malert\u001b[0m\u001b[1;33m[\u001b[0m\u001b[1;34m\"Entities\"\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    366\u001b[0m             \u001b[1;32mfor\u001b[0m \u001b[0ment\u001b[0m \u001b[1;32min\u001b[0m \u001b[0malert\u001b[0m\u001b[1;33m[\u001b[0m\u001b[1;34m\"Entities\"\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m--> 367\u001b[1;33m                 \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_add_entity_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0ment\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0malert\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mname_str\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    368\u001b[0m         \u001b[1;32mif\u001b[0m \u001b[0mincident_name\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    369\u001b[0m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0madd_link\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mincident_name\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0malert\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mname_str\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;32me:\\src\\msticpy\\msticpy\\vis\\entity_graph_tools.py\u001b[0m in \u001b[0;36m_add_entity_node\u001b[1;34m(self, ent, attached_to)\u001b[0m\n\u001b[0;32m    356\u001b[0m     \u001b[1;32mdef\u001b[0m \u001b[0m_add_entity_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mself\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0ment\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mattached_to\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;32mNone\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    357\u001b[0m         \u001b[1;34m\"\"\"Add an Entity to the graph.\"\"\"\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m--> 358\u001b[1;33m         \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0malertentity_graph\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mnx\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mcompose\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0malertentity_graph\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0ment\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mto_networkx\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    359\u001b[0m         \u001b[1;32mif\u001b[0m \u001b[0mattached_to\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    360\u001b[0m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0madd_link\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mattached_to\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0ment\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mname_str\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;32me:\\src\\msticpy\\msticpy\\datamodel\\entities\\entity.py\u001b[0m in \u001b[0;36mto_networkx\u001b[1;34m(self, graph)\u001b[0m\n\u001b[0;32m    564\u001b[0m         \u001b[0mgraph\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mgraph\u001b[0m \u001b[1;32mor\u001b[0m \u001b[0mnx\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mGraph\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    565\u001b[0m         \u001b[1;32mif\u001b[0m \u001b[1;32mnot\u001b[0m \u001b[0mgraph\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mhas_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mself\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m--> 566\u001b[1;33m             \u001b[0mgraph\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0madd_node\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mname_str\u001b[0m\u001b[1;33m,\u001b[0m \u001b[1;33m**\u001b[0m\u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mnode_properties\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    567\u001b[0m         \u001b[1;32mfor\u001b[0m \u001b[0medge\u001b[0m \u001b[1;32min\u001b[0m \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0medges\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    568\u001b[0m             if not isinstance(edge.source, Entity) or not isinstance(\n",
      "\u001b[1;32mF:\\anaconda\\envs\\msticpy\\lib\\site-packages\\networkx\\classes\\graph.py\u001b[0m in \u001b[0;36madd_node\u001b[1;34m(self, node_for_adding, **attr)\u001b[0m\n\u001b[0;32m    517\u001b[0m         \u001b[1;32mif\u001b[0m \u001b[0mnode_for_adding\u001b[0m \u001b[1;32mnot\u001b[0m \u001b[1;32min\u001b[0m \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_node\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    518\u001b[0m             \u001b[1;32mif\u001b[0m \u001b[0mnode_for_adding\u001b[0m \u001b[1;32mis\u001b[0m \u001b[1;32mNone\u001b[0m\u001b[1;33m:\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m--> 519\u001b[1;33m                 \u001b[1;32mraise\u001b[0m \u001b[0mValueError\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;34m\"None cannot be a node\"\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    520\u001b[0m             \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_adj\u001b[0m\u001b[1;33m[\u001b[0m\u001b[0mnode_for_adding\u001b[0m\u001b[1;33m]\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0madjlist_inner_dict_factory\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    521\u001b[0m             \u001b[0mattr_dict\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0m_node\u001b[0m\u001b[1;33m[\u001b[0m\u001b[0mnode_for_adding\u001b[0m\u001b[1;33m]\u001b[0m \u001b[1;33m=\u001b[0m \u001b[0mself\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mnode_attr_dict_factory\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;31mValueError\u001b[0m: None cannot be a node"
     ]
    }
   ],
   "source": [
    "sample_alert = {\n",
    "    \"StartTimeUtc\": \"2018-09-27 16:59:16\",\n",
    "    \"EndTimeUtc\": \"2018-09-27 16:59:16\",\n",
    "    \"ProviderAlertId\": \"b6329e79-0a94-4035-beee-c2e2657b71e3\",\n",
    "    \"SystemAlertId\": \"2518642332435550951_b6329e79-0a94-4035-beee-c2\",\n",
    "    \"ProviderName\": \"Detection\",\n",
    "    \"VendorName\": \"Microsoft\",\n",
    "    \"AlertType\": \"RegistryPersistence\",\n",
    "    \"AlertDisplayName\": \"Windows registry persistence method detected\",\n",
    "    \"Severity\": \"Low\",\n",
    "    \"IsIncident\": False,\n",
    "    \"ExtendedProperties\": {\n",
    "        \"resourceType\": \"Non-Azure Resource\"\n",
    "    },\n",
    "    \"CompromisedEntity\": \"TESTHOST\",\n",
    "    \"Entities\": [\n",
    "        {\n",
    "            \"Type\": \"host\",\n",
    "            \"$id\": \"1\",\n",
    "            \"HostName\": \"TESTHOST\",\n",
    "            \"DnsDomain\": \"DOM.CONTOSO.COM\",\n",
    "            \"IsDomainJoined\": True,\n",
    "            \"NTDomain\": \"DOM\",\n",
    "            \"NetBiosName\": \"TESTHOST\",\n",
    "            \"OsVersion\": None,\n",
    "            \"OSFamily\": \"Windows\",\n",
    "        },\n",
    "        {\n",
    "            \"Type\": \"process\",\n",
    "            \"$id\": \"3\",\n",
    "            \"CommandLine\": \"\",\n",
    "            \"Host\": {\"$ref\": \"1\"},\n",
    "            \"ProcessId\": \"0x940\",\n",
    "            \"ImageFile\": \"test.exe\",\n",
    "        },\n",
    "    ],\n",
    "    \"ConfidenceLevel\": \"Unknown\",\n",
    "    \"ConfidenceScore\": None,\n",
    "    \"ConfidenceReasons\": None,\n",
    "    \"Intent\": \"Persistence\",\n",
    "    \"ExtendedLinks\": None,\n",
    "    \"AzureResourceId\": None,\n",
    "    \"AzureResourceSubscriptionId\": None,\n",
    "    \"TenantId\": \"b6329e79-0a94-4035-beee-c2e2657b71e3\",\n",
    "    \"WorkspaceId\": \"b6329e79-0a94-4035-beee-c2e2657b71e3\",\n",
    "    \"AgentId\": \"b6329e79-0a94-4035-beee-c2e2657b71e3\",\n",
    "    \"SourceComputerId\": \"b6329e79-0a94-4035-beee-c2e2657b71e3\",\n",
    "    \"SystemSource\": \"Non-Azure\",\n",
    "    \"WorkspaceSubscriptionId\": \"b6329e79-0a94-4035-beee-c2e2657b71e3\",\n",
    "    \"WorkspaceResourceGroup\": \"test-east-us\",\n",
    "    \"TimeGeneratedUtc\": \"2018-09-27 16:59:47\",\n",
    "}\n",
    "alert = Alert(sample_alert)\n",
    "\n",
    "graph = EntityGraph(alert)\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Exception reporting mode: Verbose\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1429\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1429\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1429\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1430\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1430\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1430\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"a6d0234a-ef53-4f46-99d9-57917ee6c826\" data-root-id=\"1431\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"571c46d9-a428-4364-b000-affd930bf7aa\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"1442\"}],\"center\":[{\"id\":\"1445\"},{\"id\":\"1449\"},{\"id\":\"1481\"},{\"id\":\"1482\"},{\"id\":\"1483\"}],\"height\":800,\"left\":[{\"id\":\"1446\"}],\"renderers\":[{\"id\":\"1466\"}],\"title\":{\"id\":\"1432\"},\"toolbar\":{\"id\":\"1457\"},\"width\":800,\"x_range\":{\"id\":\"1434\"},\"x_scale\":{\"id\":\"1438\"},\"y_range\":{\"id\":\"1436\"},\"y_scale\":{\"id\":\"1440\"}},\"id\":\"1431\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{},\"id\":\"1542\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"1455\",\"type\":\"HelpTool\"},{\"attributes\":{\"overlay\":{\"id\":\"1456\"}},\"id\":\"1452\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"1450\",\"type\":\"PanTool\"},{\"attributes\":{\"data_source\":{\"id\":\"1468\"},\"glyph\":{\"id\":\"1476\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"1470\"}},\"id\":\"1469\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1447\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"1543\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"text\":\"Alert: Windows registry persistence method detected\",\"text_font_size\":\"10pt\",\"x\":1.9793461827919983,\"x_offset\":5,\"y\":0.5716718456367739,\"y_offset\":5},\"id\":\"1481\",\"type\":\"Label\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"1476\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"1537\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"1440\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"1454\",\"type\":\"ResetTool\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"1450\"},{\"id\":\"1451\"},{\"id\":\"1452\"},{\"id\":\"1453\"},{\"id\":\"1454\"},{\"id\":\"1455\"},{\"id\":\"1464\"}]},\"id\":\"1457\",\"type\":\"Toolbar\"},{\"attributes\":{\"axis\":{\"id\":\"1446\"},\"dimension\":1,\"ticker\":null},\"id\":\"1449\",\"type\":\"Grid\"},{\"attributes\":{\"formatter\":{\"id\":\"1530\"},\"major_label_policy\":{\"id\":\"1529\"},\"ticker\":{\"id\":\"1447\"}},\"id\":\"1446\",\"type\":\"LinearAxis\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"1473\"},\"inspection_policy\":{\"id\":\"1536\"},\"layout_provider\":{\"id\":\"1475\"},\"node_renderer\":{\"id\":\"1469\"},\"selection_policy\":{\"id\":\"1537\"}},\"id\":\"1466\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1436\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"1546\",\"type\":\"Selection\"},{\"attributes\":{\"graph_layout\":{\"Alert: Windows registry persistence method detected\":[1.9793461827919983,0.5716718456367739],\"TESTHOST\":[-1.4847554323457248,1.4283281543632267],\"test.exe\":[-0.49459075044627215,-2.0]}},\"id\":\"1475\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{},\"id\":\"1453\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"1547\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data_source\":{\"id\":\"1472\"},\"glyph\":{\"id\":\"1471\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"1474\"}},\"id\":\"1473\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"color\":[\"orange\",\"green\",\"green\"],\"description\":[\"Windows registry persistence method detected (2018-09-27 16:59:16) TESTHOST\",\"TESTHOST.DOM.CONTOSO.COM (OSFamily.Windows)\",null],\"end_time\":[\"2018-09-27 16:59:16\",null,null],\"entitytype\":[\"alert\",\"host\",\"process\"],\"index\":[\"Alert: Windows registry persistence method detected\",\"TESTHOST\",\"test.exe\"],\"name\":[\"Windows registry persistence method detected\",\"TESTHOST\",\"test.exe\"],\"node_color\":[\"orange\",\"green\",\"green\"],\"node_type\":[\"alert\",\"entity\",\"entity\"],\"source\":[\"{ 'AdditionalData': { 'AgentId': 'b6329e79-0a94-4035-beee-c2e2657b71e3',\\n                      'AzureResourceId': None,\\n                      'AzureResourceSubscriptionId': None,\\n                      'ConfidenceLevel': 'Unknown',\\n                      'ConfidenceReasons': None,\\n                      'ConfidenceScore': None,\\n                      'ExtendedLinks': None,\\n                      'ExtendedProperties': {'resourceType': 'Non-Azure Resource'},\\n                      'Intent': 'Persistence',\\n                      'IsIncident': False,\\n                      'ProviderAlertId': 'b6329e79-0a94-4035-beee-c2e2657b71e3',\\n                      'SourceComputerId': 'b6329e79-0a94-4035-beee-c2e2657b71e3',\\n                      'SystemSource': 'Non-Azure',\\n                      'TenantId': 'b6329e79-0a94-4035-beee-c2e2657b71e3',\\n                      'TimeGeneratedUtc': '2018-09-27 16:59:47',\\n                      'WorkspaceId': 'b6329e79-0a94-4035-beee-c2e2657b71e3',\\n                      'WorkspaceResourceGroup': 'test-east-us',\\n                      'WorkspaceSubscriptionId': 'b6329e79-0a94-4035-beee-c2e2657b71e3'},\\n  'AlertType': 'RegistryPersistence',\\n  'CompromisedEntity': 'TESTHOST',\\n  'DisplayName': 'Windows registry persistence method detected',\\n  'EndTimeUtc': '2018-09-27 16:59:16',\\n  'Entities': [ Host(DnsDomain=DOM.CONTOSO.COM, NTDomain=DOM, HostName=TESTHOST, NetBiosName=TESTHOST...),\\n                Process(ProcessId=0x940, CreationTimeUtc=0001-01-01 00:00:00, ImageFile=test.exe, Host={...)],\\n  'ProviderName': 'Detection',\\n  'Severity': 'Low',\\n  'StartTimeUtc': '2018-09-27 16:59:16',\\n  'SystemAlertIds': ['2518642332435550951_b6329e79-0a94-4035-beee-c2'],\\n  'Type': 'alerts',\\n  'VendorName': 'Microsoft',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'DnsDomain': 'DOM.CONTOSO.COM',\\n  'HostName': 'TESTHOST',\\n  'IsDomainJoined': True,\\n  'NTDomain': 'DOM',\\n  'NetBiosName': 'TESTHOST',\\n  'OSFamily': <OSFamily.Windows: 1>,\\n  'Type': 'host',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'CommandLine': '',\\n  'CreationTimeUtc': datetime.datetime(1, 1, 1, 0, 0),\\n  'Host': { 'AdditionalData': {},\\n            'DnsDomain': 'DOM.CONTOSO.COM',\\n            'HostName': 'TESTHOST',\\n            'IsDomainJoined': True,\\n            'NTDomain': 'DOM',\\n            'NetBiosName': 'TESTHOST',\\n            'OSFamily': <OSFamily.Windows: 1>,\\n            'Type': 'host',\\n            'edges': {Edge(name=Host}},\\n  'ImageFile': 'test.exe',\\n  'ProcessId': '0x940',\\n  'Type': 'process',\\n  'edges': {Edge(name=Host}}\"],\"start_time\":[\"2018-09-27 16:59:16\",null,null],\"time_generated\":[null,null,null]},\"selected\":{\"id\":\"1546\"},\"selection_policy\":{\"id\":\"1547\"}},\"id\":\"1468\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"1432\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"1530\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"axis\":{\"id\":\"1442\"},\"ticker\":null},\"id\":\"1445\",\"type\":\"Grid\"},{\"attributes\":{\"source\":{\"id\":\"1472\"}},\"id\":\"1474\",\"type\":\"CDSView\"},{\"attributes\":{\"source\":{\"id\":\"1468\"}},\"id\":\"1470\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1451\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"1464\",\"type\":\"HoverTool\"},{\"attributes\":{\"text\":\"TESTHOST\",\"text_font_size\":\"10pt\",\"x\":-1.4847554323457248,\"x_offset\":5,\"y\":1.4283281543632267,\"y_offset\":5},\"id\":\"1482\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1471\",\"type\":\"MultiLine\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1434\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"1548\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1443\",\"type\":\"BasicTicker\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1456\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"data\":{\"end\":[\"TESTHOST\",\"test.exe\",\"test.exe\"],\"start\":[\"Alert: Windows registry persistence method detected\",\"Alert: Windows registry persistence method detected\",\"TESTHOST\"]},\"selected\":{\"id\":\"1548\"},\"selection_policy\":{\"id\":\"1549\"}},\"id\":\"1472\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"text\":\"test.exe\",\"text_font_size\":\"10pt\",\"x\":-0.49459075044627215,\"x_offset\":5,\"y\":-2.0,\"y_offset\":5},\"id\":\"1483\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1536\",\"type\":\"NodesOnly\"},{\"attributes\":{\"formatter\":{\"id\":\"1543\"},\"major_label_policy\":{\"id\":\"1542\"},\"ticker\":{\"id\":\"1443\"}},\"id\":\"1442\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1529\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"1549\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1438\",\"type\":\"LinearScale\"}],\"root_ids\":[\"1431\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"571c46d9-a428-4364-b000-affd930bf7aa\",\"root_ids\":[\"1431\"],\"roots\":{\"1431\":\"a6d0234a-ef53-4f46-99d9-57917ee6c826\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1431"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'1431', <span id=\"1673\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='1442', ...)],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='1445', ...), Grid(id='1449', ...), Label(id='1481', ...), Label(id='1482', ...), Label(id='1483', ...)],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='1446', ...)],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='1466', ...)],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='1432', ...),</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='1457', ...),</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='1434', ...),</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='1438', ...),</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='1436', ...),</div></div><div class=\"1672\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='1440', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"1673\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"1672\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='1431', ...)"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "sec_alert = SecurityAlert(pd.Series(sample_alert))\n",
    "\n",
    "graph = EntityGraph(sec_alert)\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As can be seen above creating a graph from an Alert or SecurityAlert produces the same graph output. Here we can see the relationship between the entities and the alert, as well as between the two entities.\n",
    "\n",
    "Graphs can also be created with just an entity if that is the starting point of the investigation:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1675\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1675\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1675\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1676\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1676\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1676\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"eb4cc2c6-6543-467b-938d-8e11edf6e69b\" data-root-id=\"1677\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"d1f84ee3-4c61-4d9f-84fa-8570ffae256b\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"1688\"}],\"center\":[{\"id\":\"1691\"},{\"id\":\"1695\"},{\"id\":\"1727\"}],\"height\":800,\"left\":[{\"id\":\"1692\"}],\"renderers\":[{\"id\":\"1712\"}],\"title\":{\"id\":\"1678\"},\"toolbar\":{\"id\":\"1703\"},\"width\":800,\"x_range\":{\"id\":\"1680\"},\"x_scale\":{\"id\":\"1684\"},\"y_range\":{\"id\":\"1682\"},\"y_scale\":{\"id\":\"1686\"}},\"id\":\"1677\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"source\":{\"id\":\"1714\"}},\"id\":\"1716\",\"type\":\"CDSView\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1682\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"1814\",\"type\":\"Selection\"},{\"attributes\":{\"data\":{\"end\":[],\"start\":[]},\"selected\":{\"id\":\"1814\"},\"selection_policy\":{\"id\":\"1815\"}},\"id\":\"1718\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"1815\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"1719\"},\"inspection_policy\":{\"id\":\"1802\"},\"layout_provider\":{\"id\":\"1721\"},\"node_renderer\":{\"id\":\"1715\"},\"selection_policy\":{\"id\":\"1803\"}},\"id\":\"1712\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"data_source\":{\"id\":\"1718\"},\"glyph\":{\"id\":\"1717\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"1720\"}},\"id\":\"1719\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1686\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"1808\",\"type\":\"AllLabels\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1702\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"source\":{\"id\":\"1718\"}},\"id\":\"1720\",\"type\":\"CDSView\"},{\"attributes\":{\"formatter\":{\"id\":\"1796\"},\"major_label_policy\":{\"id\":\"1795\"},\"ticker\":{\"id\":\"1693\"}},\"id\":\"1692\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1809\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1680\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"1684\",\"type\":\"LinearScale\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"1710\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"1796\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"text\":\"www.contoso.com\",\"text_font_size\":\"10pt\",\"x\":0,\"x_offset\":5,\"y\":0,\"y_offset\":5},\"id\":\"1727\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1803\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"1701\",\"type\":\"HelpTool\"},{\"attributes\":{\"data\":{\"color\":[\"green\"],\"description\":[\"www.contoso.com\"],\"end_time\":[null],\"entitytype\":[\"url\"],\"index\":[\"www.contoso.com\"],\"name\":[\"www.contoso.com\"],\"node_color\":[\"green\"],\"node_type\":[\"entity\"],\"source\":[\"{'AdditionalData': {}, 'Type': 'url', 'Url': 'www.contoso.com', 'edges': set()}\"],\"start_time\":[null]},\"selected\":{\"id\":\"1812\"},\"selection_policy\":{\"id\":\"1813\"}},\"id\":\"1714\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"1722\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"1714\"},\"glyph\":{\"id\":\"1722\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"1716\"}},\"id\":\"1715\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"formatter\":{\"id\":\"1809\"},\"major_label_policy\":{\"id\":\"1808\"},\"ticker\":{\"id\":\"1689\"}},\"id\":\"1688\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1700\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"1689\",\"type\":\"BasicTicker\"},{\"attributes\":{\"axis\":{\"id\":\"1688\"},\"ticker\":null},\"id\":\"1691\",\"type\":\"Grid\"},{\"attributes\":{\"graph_layout\":{\"www.contoso.com\":[0,0]}},\"id\":\"1721\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{},\"id\":\"1812\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1802\",\"type\":\"NodesOnly\"},{\"attributes\":{\"axis\":{\"id\":\"1692\"},\"dimension\":1,\"ticker\":null},\"id\":\"1695\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"1813\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1693\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"1717\",\"type\":\"MultiLine\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"1678\",\"type\":\"Title\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"1696\"},{\"id\":\"1697\"},{\"id\":\"1698\"},{\"id\":\"1699\"},{\"id\":\"1700\"},{\"id\":\"1701\"},{\"id\":\"1710\"}]},\"id\":\"1703\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"1697\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"1696\",\"type\":\"PanTool\"},{\"attributes\":{\"overlay\":{\"id\":\"1702\"}},\"id\":\"1698\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"1699\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"1795\",\"type\":\"AllLabels\"}],\"root_ids\":[\"1677\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"d1f84ee3-4c61-4d9f-84fa-8570ffae256b\",\"root_ids\":[\"1677\"],\"roots\":{\"1677\":\"eb4cc2c6-6543-467b-938d-8e11edf6e69b\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1677"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'1677', <span id=\"1939\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='1688', ...)],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='1691', ...), Grid(id='1695', ...), Label(id='1727', ...)],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='1692', ...)],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='1712', ...)],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='1678', ...),</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='1703', ...),</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='1680', ...),</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='1684', ...),</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='1682', ...),</div></div><div class=\"1938\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='1686', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"1939\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"1938\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='1677', ...)"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "url_ent = Url({\"Url\": \"www.contoso.com\"})\n",
    "graph = EntityGraph(url_ent)\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Creating graphs from DataFrames.\n",
    "It is also possible to create graphs containing multiple alerts or incidents by passing a DataFrame containing incident or alert events to `EntityGraph` this will then convert these to the relevant entity type and plot them all on the one graph.\n",
    "\n",
    "<div class=\"alert alert-block alert-info\">\n",
    "<b>Note:</b> There is also a Pandas accessor for this feature that allows for graph creation and plotting direct from a DataFrame with `df.mp_incident_graph.plot()`\n",
    "</div>\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1941\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1941\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1941\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1942\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1942\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1942\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"2481655c-7e81-41bf-8791-ce7f3dd831dc\" data-root-id=\"1943\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"d7139851-a04c-4210-ab4c-08046516653b\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"1954\"}],\"center\":[{\"id\":\"1957\"},{\"id\":\"1961\"},{\"id\":\"1993\"},{\"id\":\"1994\"},{\"id\":\"1995\"},{\"id\":\"1996\"},{\"id\":\"1997\"},{\"id\":\"1998\"},{\"id\":\"1999\"},{\"id\":\"2000\"},{\"id\":\"2001\"},{\"id\":\"2002\"}],\"height\":800,\"left\":[{\"id\":\"1958\"}],\"renderers\":[{\"id\":\"1978\"}],\"title\":{\"id\":\"1944\"},\"toolbar\":{\"id\":\"1969\"},\"width\":800,\"x_range\":{\"id\":\"1946\"},\"x_scale\":{\"id\":\"1950\"},\"y_range\":{\"id\":\"1948\"},\"y_scale\":{\"id\":\"1952\"}},\"id\":\"1943\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1968\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"1950\",\"type\":\"LinearScale\"},{\"attributes\":{\"formatter\":{\"id\":\"2093\"},\"major_label_policy\":{\"id\":\"2092\"},\"ticker\":{\"id\":\"1959\"}},\"id\":\"1958\",\"type\":\"LinearAxis\"},{\"attributes\":{\"text\":\"Alert: qdbbijed\",\"text_font_size\":\"10pt\",\"x\":-1.3248762102494573,\"x_offset\":5,\"y\":1.1894287624019313,\"y_offset\":5},\"id\":\"1994\",\"type\":\"Label\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1948\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2109\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1967\",\"type\":\"HelpTool\"},{\"attributes\":{},\"id\":\"2110\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"text_font_size\":\"10pt\",\"x\":-1.8772444927857692,\"x_offset\":5,\"y\":-0.7528970954662807,\"y_offset\":5},\"id\":\"1995\",\"type\":\"Label\"},{\"attributes\":{\"data_source\":{\"id\":\"1980\"},\"glyph\":{\"id\":\"1988\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"1982\"}},\"id\":\"1981\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"1946\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2092\",\"type\":\"AllLabels\"},{\"attributes\":{\"axis\":{\"id\":\"1954\"},\"ticker\":null},\"id\":\"1957\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"2093\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"1976\",\"type\":\"HoverTool\"},{\"attributes\":{\"axis\":{\"id\":\"1958\"},\"dimension\":1,\"ticker\":null},\"id\":\"1961\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"2111\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"2100\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"1959\",\"type\":\"BasicTicker\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"1985\"},\"inspection_policy\":{\"id\":\"2099\"},\"layout_provider\":{\"id\":\"1987\"},\"node_renderer\":{\"id\":\"1981\"},\"selection_policy\":{\"id\":\"2100\"}},\"id\":\"1978\",\"type\":\"GraphRenderer\"},{\"attributes\":{},\"id\":\"2099\",\"type\":\"NodesOnly\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"1962\"},{\"id\":\"1963\"},{\"id\":\"1964\"},{\"id\":\"1965\"},{\"id\":\"1966\"},{\"id\":\"1967\"},{\"id\":\"1976\"}]},\"id\":\"1969\",\"type\":\"Toolbar\"},{\"attributes\":{\"text\":\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"text_font_size\":\"10pt\",\"x\":0.6818685543887336,\"x_offset\":5,\"y\":-1.6785596236830196,\"y_offset\":5},\"id\":\"2001\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1962\",\"type\":\"PanTool\"},{\"attributes\":{\"formatter\":{\"id\":\"2106\"},\"major_label_policy\":{\"id\":\"2105\"},\"ticker\":{\"id\":\"1955\"}},\"id\":\"1954\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1963\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"1955\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"1965\",\"type\":\"SaveTool\"},{\"attributes\":{\"text\":\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"text_font_size\":\"10pt\",\"x\":1.095604485822148,\"x_offset\":5,\"y\":1.724112984932021,\"y_offset\":5},\"id\":\"2000\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"1966\",\"type\":\"ResetTool\"},{\"attributes\":{\"text\":\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"text_font_size\":\"10pt\",\"x\":1.1461138627963827,\"x_offset\":5,\"y\":1.4861248256362514,\"y_offset\":5},\"id\":\"1999\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2105\",\"type\":\"AllLabels\"},{\"attributes\":{\"text\":\"Alert: naebofkqlmonbrmloaonffmdjipln\",\"text_font_size\":\"10pt\",\"x\":1.4501021793647468,\"x_offset\":5,\"y\":-0.004568474622077024,\"y_offset\":5},\"id\":\"1998\",\"type\":\"Label\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: qdbbijed\",\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Alert: naebofkqlmonbrmloaonffmdjipln\",\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"start\":[\"Incident: qdbbijed\",\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Incident: naebofkqlmonbrmloaonffmdjipln\",\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"]},\"selected\":{\"id\":\"2111\"},\"selection_policy\":{\"id\":\"2112\"}},\"id\":\"1984\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"overlay\":{\"id\":\"1968\"}},\"id\":\"1964\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"1983\",\"type\":\"MultiLine\"},{\"attributes\":{},\"id\":\"2112\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"text_font_size\":\"10pt\",\"x\":0.4525365426662028,\"x_offset\":5,\"y\":-1.7614256211780464,\"y_offset\":5},\"id\":\"2002\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Incident: qdbbijed\",\"text_font_size\":\"10pt\",\"x\":-1.1496615073482244,\"x_offset\":5,\"y\":0.9954652482387912,\"y_offset\":5},\"id\":\"1993\",\"type\":\"Label\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"1988\",\"type\":\"Circle\"},{\"attributes\":{\"text\":\"Incident: naebofkqlmonbrmloaonffmdjipln\",\"text_font_size\":\"10pt\",\"x\":1.525556585345237,\"x_offset\":5,\"y\":-0.23432035605513873,\"y_offset\":5},\"id\":\"1997\",\"type\":\"Label\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\"],\"description\":[\"2021-10-01T17:52:21.5763494Z - qdbbijed - lciaqlfodrimcjjcckdppidjrnoobqllnafe\",\"qdbbijed - ['alfojbqollofnjoiboaacndnkceqjmfbmrpq']\",\"2021-10-01T17:44:44.4768467Z - mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela - nmejajbiqrpqkqlbjqedrrqndlmrppldoibd\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela - ['ffrromboaamlmjmlmopefnldpbklbeqqirqm']\",\"2021-10-01T17:29:50.1999887Z - naebofkqlmonbrmloaonffmdjipln - ppffjqndimadciqjqqkakaabjabcfbilraeb\",\"naebofkqlmonbrmloaonffmdjipln - ['rlklbkeeqiekrkkjbkqfebkdcamjknpnparl']\",\"2021-10-01T16:52:35.8429041Z - qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp - dbkkfqcdnbciapjajpbdbimroidmfqljfmjd\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp - ['lfrdecrklremkcioileamdelqdiirmrrmlkp']\",\"2021-10-01T16:49:43.6929517Z - ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje - ppfnqmqlakpmqcnnnniofmjoomenilncrqfj\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje - ['aamkfdroimrrliaqkleppqkbijprdfmoecfe']\"],\"end_time\":[\"2021-10-01T16:01:48.872Z\",null,\"2021-10-01T15:09:54.128Z\",null,\"2021-10-01T17:24:44.6661059Z\",null,\"2021-10-01T16:11:23.6728107Z\",null,\"2021-10-01T16:44:38.190647Z\",null],\"entitytype\":[\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\"],\"index\":[\"Incident: qdbbijed\",\"Alert: qdbbijed\",\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Incident: naebofkqlmonbrmloaonffmdjipln\",\"Alert: naebofkqlmonbrmloaonffmdjipln\",\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"name\":[\"qdbbijed\",\"qdbbijed\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"naebofkqlmonbrmloaonffmdjipln\",\"naebofkqlmonbrmloaonffmdjipln\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"node_color\":[\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\"],\"node_type\":[\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\"],\"source\":[null,\"{ 'AdditionalData': {'ID': 'alfojbqollofnjoiboaacndnkceqjmfbmrpq', 'Name': 'qdbbijed'},\\n  'DisplayName': 'qdbbijed',\\n  'SystemAlertIds': ['alfojbqollofnjoiboaacndnkceqjmfbmrpq'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'ffrromboaamlmjmlmopefnldpbklbeqqirqm',\\n                      'Name': 'mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela'},\\n  'DisplayName': 'mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela',\\n  'SystemAlertIds': ['ffrromboaamlmjmlmopefnldpbklbeqqirqm'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'rlklbkeeqiekrkkjbkqfebkdcamjknpnparl',\\n                      'Name': 'naebofkqlmonbrmloaonffmdjipln'},\\n  'DisplayName': 'naebofkqlmonbrmloaonffmdjipln',\\n  'SystemAlertIds': ['rlklbkeeqiekrkkjbkqfebkdcamjknpnparl'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'lfrdecrklremkcioileamdelqdiirmrrmlkp',\\n                      'Name': 'qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp'},\\n  'DisplayName': 'qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp',\\n  'SystemAlertIds': ['lfrdecrklremkcioileamdelqdiirmrrmlkp'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'aamkfdroimrrliaqkleppqkbijprdfmoecfe',\\n                      'Name': 'ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje'},\\n  'DisplayName': 'ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje',\\n  'SystemAlertIds': ['aamkfdroimrrliaqkleppqkbijprdfmoecfe'],\\n  'Type': 'alerts',\\n  'edges': set()}\"],\"start_time\":[\"2021-09-30T12:01:34.374Z\",null,\"2021-10-01T15:09:54.128Z\",null,\"2021-09-17T17:24:44.6661059Z\",null,\"2021-10-01T11:11:23.6728107Z\",null,\"2021-09-30T15:44:38.190647Z\",null],\"time_generated\":[\"2021-10-01T17:52:21.5763494Z\",null,\"2021-10-01T17:44:44.4768467Z\",null,\"2021-10-01T17:29:50.1999887Z\",null,\"2021-10-01T16:52:35.8429041Z\",null,\"2021-10-01T16:49:43.6929517Z\",null]},\"selected\":{\"id\":\"2109\"},\"selection_policy\":{\"id\":\"2110\"}},\"id\":\"1980\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"2106\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"source\":{\"id\":\"1984\"}},\"id\":\"1986\",\"type\":\"CDSView\"},{\"attributes\":{\"data_source\":{\"id\":\"1984\"},\"glyph\":{\"id\":\"1983\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"1986\"}},\"id\":\"1985\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"text\":\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"text_font_size\":\"10pt\",\"x\":-2.0,\"x_offset\":5,\"y\":-0.963360650204433,\"y_offset\":5},\"id\":\"1996\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"1944\",\"type\":\"Title\"},{\"attributes\":{\"source\":{\"id\":\"1980\"}},\"id\":\"1982\",\"type\":\"CDSView\"},{\"attributes\":{\"graph_layout\":{\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\":[0.4525365426662028,-1.7614256211780464],\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\":[-2.0,-0.963360650204433],\"Alert: naebofkqlmonbrmloaonffmdjipln\":[1.4501021793647468,-0.004568474622077024],\"Alert: qdbbijed\":[-1.3248762102494573,1.1894287624019313],\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\":[1.095604485822148,1.724112984932021],\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\":[0.6818685543887336,-1.6785596236830196],\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\":[-1.8772444927857692,-0.7528970954662807],\"Incident: naebofkqlmonbrmloaonffmdjipln\":[1.525556585345237,-0.23432035605513873],\"Incident: qdbbijed\":[-1.1496615073482244,0.9954652482387912],\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\":[1.1461138627963827,1.4861248256362514]}},\"id\":\"1987\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{},\"id\":\"1952\",\"type\":\"LinearScale\"}],\"root_ids\":[\"1943\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"d7139851-a04c-4210-ab4c-08046516653b\",\"root_ids\":[\"1943\"],\"roots\":{\"1943\":\"2481655c-7e81-41bf-8791-ce7f3dd831dc\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1943"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'1943', <span id=\"2236\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='1954', ...)],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='1957', ...), Grid(id='1961', ...), Label(id='1993', ...), Label(id='1994', ...), Label(id='1995', ...), Label(id='1996', ...), Label(id='1997', ...), Label(id='1998', ...), Label(id='1999', ...), Label(id='2000', ...), Label(id='2001', ...), Label(id='2002', ...)],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='1958', ...)],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='1978', ...)],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='1944', ...),</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='1969', ...),</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='1946', ...),</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='1950', ...),</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='1948', ...),</div></div><div class=\"2235\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='1952', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"2236\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"2235\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='1943', ...)"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = pd.read_pickle(\"data/sent_incidents.pkl\")\n",
    "df_graph = EntityGraph(df)\n",
    "df_graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Plotting a graph\n",
    "\n",
    "As we have seen above a visual representation of the graph can be produced by calling `.plot`. However you can also choose to return but not display the plot by passing the `hide=True` parameter when calling `.plot`:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2238\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2238\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2238\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "graph_out = df_graph.plot(hide=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Plotting a graph with a timeline\n",
    "\n",
    "Its often useful to see not just the connection between enities in a graph but also how they relate to each other temporarily, for example to see if two entities of suspicion overlap in the times observed, or whether two similar incidents have an overlap in terms of times assocaited. This can be done by calling `.plot_with_timeline`. \n",
    "\n",
    "<div class=\"alert alert-block alert-info\">\n",
    "<b>Note:</b> In some cases entities may not have time parameters to plot, in this case the graph will be displayed on its own.\n",
    "</div>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2299\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2299\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2299\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2360\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2360\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2360\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"161010f6-3f0f-4ea7-a749-7b44d390299e\" data-root-id=\"2440\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"f6abf2b1-c950-4a4d-998e-5ea6704b3506\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"2300\"},{\"id\":\"2439\"}]},\"id\":\"2440\",\"type\":\"Column\"},{\"attributes\":{\"formatter\":{\"id\":\"2424\"},\"major_label_policy\":{\"id\":\"2466\"},\"ticker\":{\"id\":\"2419\"}},\"id\":\"2418\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"2500\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"2408\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"2473\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"2502\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"2503\",\"type\":\"YearsTicker\"},{\"attributes\":{\"graph_layout\":{\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\":[-1.9469690120696694,0.5310440518641615],\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\":[1.7351710795621333,0.4103910693711786],\"Alert: naebofkqlmonbrmloaonffmdjipln\":[-0.8091660289067765,-1.5326230084775512],\"Alert: qdbbijed\":[1.3510219801753547,-1.1983017055043368],\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\":[-0.12134956862872744,1.5845752520659322],\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\":[-2.0,0.7764033720909752],\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\":[1.480968052039605,0.29687479118350246],\"Incident: naebofkqlmonbrmloaonffmdjipln\":[-0.8467501464094224,-1.2848918871788169],\"Incident: qdbbijed\":[1.265497392922371,-1.4331604253592427],\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\":[-0.1084237486848678,1.8496884899441974]}},\"id\":\"2344\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":\"10px\"},\"id\":\"2423\",\"type\":\"Title\"},{\"attributes\":{\"source\":{\"id\":\"2362\"}},\"id\":\"2406\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"2472\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"2337\"},\"glyph\":{\"id\":\"2345\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"2339\"}},\"id\":\"2338\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"end\":1633290524666.106,\"start\":1631718044666.106},\"id\":\"2410\",\"type\":\"Range1d\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"2501\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"source\":{\"id\":\"2337\"}},\"id\":\"2339\",\"type\":\"CDSView\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\"],\"description\":[\"2021-10-01T17:52:21.5763494Z - qdbbijed - lciaqlfodrimcjjcckdppidjrnoobqllnafe\",\"qdbbijed - ['alfojbqollofnjoiboaacndnkceqjmfbmrpq']\",\"2021-10-01T17:44:44.4768467Z - mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela - nmejajbiqrpqkqlbjqedrrqndlmrppldoibd\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela - ['ffrromboaamlmjmlmopefnldpbklbeqqirqm']\",\"2021-10-01T17:29:50.1999887Z - naebofkqlmonbrmloaonffmdjipln - ppffjqndimadciqjqqkakaabjabcfbilraeb\",\"naebofkqlmonbrmloaonffmdjipln - ['rlklbkeeqiekrkkjbkqfebkdcamjknpnparl']\",\"2021-10-01T16:52:35.8429041Z - qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp - dbkkfqcdnbciapjajpbdbimroidmfqljfmjd\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp - ['lfrdecrklremkcioileamdelqdiirmrrmlkp']\",\"2021-10-01T16:49:43.6929517Z - ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje - ppfnqmqlakpmqcnnnniofmjoomenilncrqfj\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje - ['aamkfdroimrrliaqkleppqkbijprdfmoecfe']\"],\"end_time\":[\"2021-10-01T16:01:48.872Z\",null,\"2021-10-01T15:09:54.128Z\",null,\"2021-10-01T17:24:44.6661059Z\",null,\"2021-10-01T16:11:23.6728107Z\",null,\"2021-10-01T16:44:38.190647Z\",null],\"entitytype\":[\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\"],\"index\":[\"Incident: qdbbijed\",\"Alert: qdbbijed\",\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Incident: naebofkqlmonbrmloaonffmdjipln\",\"Alert: naebofkqlmonbrmloaonffmdjipln\",\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"name\":[\"qdbbijed\",\"qdbbijed\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"naebofkqlmonbrmloaonffmdjipln\",\"naebofkqlmonbrmloaonffmdjipln\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"node_color\":[\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\",\"red\",\"orange\"],\"node_type\":[\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\",\"incident\",\"alert\"],\"source\":[null,\"{ 'AdditionalData': {'ID': 'alfojbqollofnjoiboaacndnkceqjmfbmrpq', 'Name': 'qdbbijed'},\\n  'DisplayName': 'qdbbijed',\\n  'SystemAlertIds': ['alfojbqollofnjoiboaacndnkceqjmfbmrpq'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'ffrromboaamlmjmlmopefnldpbklbeqqirqm',\\n                      'Name': 'mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela'},\\n  'DisplayName': 'mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela',\\n  'SystemAlertIds': ['ffrromboaamlmjmlmopefnldpbklbeqqirqm'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'rlklbkeeqiekrkkjbkqfebkdcamjknpnparl',\\n                      'Name': 'naebofkqlmonbrmloaonffmdjipln'},\\n  'DisplayName': 'naebofkqlmonbrmloaonffmdjipln',\\n  'SystemAlertIds': ['rlklbkeeqiekrkkjbkqfebkdcamjknpnparl'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'lfrdecrklremkcioileamdelqdiirmrrmlkp',\\n                      'Name': 'qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp'},\\n  'DisplayName': 'qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp',\\n  'SystemAlertIds': ['lfrdecrklremkcioileamdelqdiirmrrmlkp'],\\n  'Type': 'alerts',\\n  'edges': set()}\",null,\"{ 'AdditionalData': { 'ID': 'aamkfdroimrrliaqkleppqkbijprdfmoecfe',\\n                      'Name': 'ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje'},\\n  'DisplayName': 'ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje',\\n  'SystemAlertIds': ['aamkfdroimrrliaqkleppqkbijprdfmoecfe'],\\n  'Type': 'alerts',\\n  'edges': set()}\"],\"start_time\":[\"2021-09-30T12:01:34.374Z\",null,\"2021-10-01T15:09:54.128Z\",null,\"2021-09-17T17:24:44.6661059Z\",null,\"2021-10-01T11:11:23.6728107Z\",null,\"2021-09-30T15:44:38.190647Z\",null],\"time_generated\":[\"2021-10-01T17:52:21.5763494Z\",null,\"2021-10-01T17:44:44.4768467Z\",null,\"2021-10-01T17:29:50.1999887Z\",null,\"2021-10-01T16:52:35.8429041Z\",null,\"2021-10-01T16:49:43.6929517Z\",null]},\"selected\":{\"id\":\"2468\"},\"selection_policy\":{\"id\":\"2469\"}},\"id\":\"2337\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"2387\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"2340\",\"type\":\"MultiLine\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: qdbbijed\",\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Alert: naebofkqlmonbrmloaonffmdjipln\",\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"start\":[\"Incident: qdbbijed\",\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"Incident: naebofkqlmonbrmloaonffmdjipln\",\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"]},\"selected\":{\"id\":\"2470\"},\"selection_policy\":{\"id\":\"2471\"}},\"id\":\"2341\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"data_source\":{\"id\":\"2341\"},\"glyph\":{\"id\":\"2340\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"2343\"}},\"id\":\"2342\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"2437\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"text\":\"Alert: naebofkqlmonbrmloaonffmdjipln\",\"text_font_size\":\"10pt\",\"x\":-0.8091660289067765,\"x_offset\":5,\"y\":-1.5326230084775512,\"y_offset\":5},\"id\":\"2355\",\"type\":\"Label\"},{\"attributes\":{\"source\":{\"id\":\"2341\"}},\"id\":\"2343\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":\"Alert: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"text_font_size\":\"10pt\",\"x\":-0.12134956862872744,\"x_offset\":5,\"y\":1.5845752520659322,\"y_offset\":5},\"id\":\"2357\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Alert: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"text_font_size\":\"10pt\",\"x\":1.7351710795621333,\"x_offset\":5,\"y\":0.4103910693711786,\"y_offset\":5},\"id\":\"2353\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Alert: qdbbijed\",\"text_font_size\":\"10pt\",\"x\":1.3510219801753547,\"x_offset\":5,\"y\":-1.1983017055043368,\"y_offset\":5},\"id\":\"2351\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2474\",\"type\":\"Selection\"},{\"attributes\":{\"text\":\"Incident: mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"text_font_size\":\"10pt\",\"x\":1.480968052039605,\"x_offset\":5,\"y\":0.29687479118350246,\"y_offset\":5},\"id\":\"2352\",\"type\":\"Label\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"2305\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2466\",\"type\":\"AllLabels\"},{\"attributes\":{\"text\":\"Incident: qdbbijed\",\"text_font_size\":\"10pt\",\"x\":1.265497392922371,\"x_offset\":5,\"y\":-1.4331604253592427,\"y_offset\":5},\"id\":\"2350\",\"type\":\"Label\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"2345\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"2475\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"Incident: naebofkqlmonbrmloaonffmdjipln\",\"text_font_size\":\"10pt\",\"x\":-0.8467501464094224,\"x_offset\":5,\"y\":-1.2848918871788169,\"y_offset\":5},\"id\":\"2354\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Incident: qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"text_font_size\":\"10pt\",\"x\":-0.1084237486848678,\"x_offset\":5,\"y\":1.8496884899441974,\"y_offset\":5},\"id\":\"2356\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Incident: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"text_font_size\":\"10pt\",\"x\":-2.0,\"x_offset\":5,\"y\":0.7764033720909752,\"y_offset\":5},\"id\":\"2358\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2324\",\"type\":\"HelpTool\"},{\"attributes\":{\"formatter\":{\"id\":\"2443\"},\"major_label_policy\":{\"id\":\"2442\"},\"ticker\":{\"id\":\"2316\"}},\"id\":\"2315\",\"type\":\"LinearAxis\"},{\"attributes\":{\"text\":\"Alert: ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"text_font_size\":\"10pt\",\"x\":-1.9469690120696694,\"x_offset\":5,\"y\":0.5310440518641615,\"y_offset\":5},\"id\":\"2359\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2307\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"2309\",\"type\":\"LinearScale\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"2301\",\"type\":\"Title\"},{\"attributes\":{\"data\":{\"Center\":{\"__ndarray__\":\"AHBfX5nDd0IAAGV5xsN3Qq6hX2iNwXdC9ozlaMHDd0Ja6sb6oMN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Description\":[\"2021-10-01T17:52:21.5763494Z - qdbbijed - lciaqlfodrimcjjcckdppidjrnoobqllnafe\",\"2021-10-01T17:44:44.4768467Z - mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela - nmejajbiqrpqkqlbjqedrrqndlmrppldoibd\",\"2021-10-01T17:29:50.1999887Z - naebofkqlmonbrmloaonffmdjipln - ppffjqndimadciqjqqkakaabjabcfbilraeb\",\"2021-10-01T16:52:35.8429041Z - qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp - dbkkfqcdnbciapjajpbdbimroidmfqljfmjd\",\"2021-10-01T16:49:43.6929517Z - ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje - ppfnqmqlakpmqcnnnniofmjoomenilncrqfj\"],\"EndTime\":{\"__ndarray__\":\"AIDUccnDd0IAAGV5xsN3Qq6hnzDOw3dC9owp/snDd0Ja6hrly8N3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Name\":[\"qdbbijed\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"naebofkqlmonbrmloaonffmdjipln\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"Row\":[3,1,2,4,0],\"StartTime\":{\"__ndarray__\":\"AGDqTGnDd0IAAGV5xsN3Qq6hH6BMv3dC9oyh07jDd0Ja6nIQdsN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"TimeGenerated\":{\"__ndarray__\":\"loUkxc/Dd0KJzYtVz8N3Qs9/N3vOw3dCdy64WczDd0I3z7AvzMN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Type\":[\"incident\",\"incident\",\"incident\",\"incident\",\"incident\"],\"Width\":{\"__ndarray__\":\"AAAAiDoJmEEAAAAAAAAAAAAAAABCBtJBAAAAAIgqcUEAAAAAKnWVQQ==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"end_time\":{\"__ndarray__\":\"AIDUccnDd0IAAGV5xsN3Qq6hnzDOw3dC9owp/snDd0Ja6hrly8N3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"index\":[0,1,2,3,4],\"start_time\":{\"__ndarray__\":\"AGDqTGnDd0IAAGV5xsN3Qq6hH6BMv3dC9oyh07jDd0Ja6nIQdsN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]}},\"selected\":{\"id\":\"2474\"},\"selection_policy\":{\"id\":\"2475\"}},\"id\":\"2362\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"2303\",\"type\":\"Range1d\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"2493\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"2456\"},\"major_label_policy\":{\"id\":\"2455\"},\"ticker\":{\"id\":\"2312\"}},\"id\":\"2311\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"2312\",\"type\":\"BasicTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2311\"},\"ticker\":null},\"id\":\"2314\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"2412\",\"type\":\"DataRange1d\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"2477\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"below\":[{\"id\":\"2418\"},{\"id\":\"2423\"}],\"center\":[{\"id\":\"2421\"}],\"height\":120,\"renderers\":[{\"id\":\"2430\"}],\"title\":{\"id\":\"2408\"},\"toolbar\":{\"id\":\"2422\"},\"toolbar_location\":null,\"width\":800,\"x_range\":{\"id\":\"2410\"},\"x_scale\":{\"id\":\"2414\"},\"y_range\":{\"id\":\"2412\"},\"y_scale\":{\"id\":\"2416\"}},\"id\":\"2407\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"2478\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"2414\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"2416\",\"type\":\"LinearScale\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"2480\",\"type\":\"DaysTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2315\"},\"dimension\":1,\"ticker\":null},\"id\":\"2318\",\"type\":\"Grid\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"2479\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"2316\",\"type\":\"BasicTicker\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"2484\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"2492\"},{\"id\":\"2493\"},{\"id\":\"2494\"},{\"id\":\"2495\"},{\"id\":\"2496\"},{\"id\":\"2497\"},{\"id\":\"2498\"},{\"id\":\"2499\"},{\"id\":\"2500\"},{\"id\":\"2501\"},{\"id\":\"2502\"},{\"id\":\"2503\"}]},\"id\":\"2419\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"2485\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"2319\"},{\"id\":\"2320\"},{\"id\":\"2321\"},{\"id\":\"2322\"},{\"id\":\"2323\"},{\"id\":\"2324\"},{\"id\":\"2333\"}]},\"id\":\"2326\",\"type\":\"Toolbar\"},{\"attributes\":{\"axis\":{\"id\":\"2418\"},\"ticker\":null},\"id\":\"2421\",\"type\":\"Grid\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"2481\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"2320\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"2468\",\"type\":\"Selection\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"2483\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"2319\",\"type\":\"PanTool\"},{\"attributes\":{\"active_multi\":{\"id\":\"2432\"},\"tools\":[{\"id\":\"2432\"}]},\"id\":\"2422\",\"type\":\"Toolbar\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"2487\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"overlay\":{\"id\":\"2325\"}},\"id\":\"2321\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"2469\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"2482\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"2322\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"2488\",\"type\":\"YearsTicker\"},{\"attributes\":{},\"id\":\"2323\",\"type\":\"ResetTool\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"2486\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"2455\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"2470\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"2456\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"2471\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5,\"syncable\":false},\"id\":\"2433\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"2489\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"2490\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"2325\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"2424\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"overlay\":{\"id\":\"2433\"},\"x_range\":{\"id\":\"2367\"},\"y_range\":null},\"id\":\"2432\",\"type\":\"RangeTool\"},{\"attributes\":{\"data\":{\"Center\":{\"__ndarray__\":\"AHBfX5nDd0IAAGV5xsN3Qq6hX2iNwXdC9ozlaMHDd0Ja6sb6oMN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Description\":[\"2021-10-01T17:52:21.5763494Z - qdbbijed - lciaqlfodrimcjjcckdppidjrnoobqllnafe\",\"2021-10-01T17:44:44.4768467Z - mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela - nmejajbiqrpqkqlbjqedrrqndlmrppldoibd\",\"2021-10-01T17:29:50.1999887Z - naebofkqlmonbrmloaonffmdjipln - ppffjqndimadciqjqqkakaabjabcfbilraeb\",\"2021-10-01T16:52:35.8429041Z - qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp - dbkkfqcdnbciapjajpbdbimroidmfqljfmjd\",\"2021-10-01T16:49:43.6929517Z - ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje - ppfnqmqlakpmqcnnnniofmjoomenilncrqfj\"],\"EndTime\":{\"__ndarray__\":\"AIDUccnDd0IAAGV5xsN3Qq6hnzDOw3dC9owp/snDd0Ja6hrly8N3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Name\":[\"qdbbijed\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"naebofkqlmonbrmloaonffmdjipln\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\",\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\"],\"Row\":[3,1,2,4,0],\"StartTime\":{\"__ndarray__\":\"AGDqTGnDd0IAAGV5xsN3Qq6hH6BMv3dC9oyh07jDd0Ja6nIQdsN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"TimeGenerated\":{\"__ndarray__\":\"loUkxc/Dd0KJzYtVz8N3Qs9/N3vOw3dCdy64WczDd0I3z7AvzMN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Type\":[\"incident\",\"incident\",\"incident\",\"incident\",\"incident\"],\"Width\":{\"__ndarray__\":\"AAAAiDoJmEEAAAAAAAAAAAAAAABCBtJBAAAAAIgqcUEAAAAAKnWVQQ==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"end_time\":{\"__ndarray__\":\"AIDUccnDd0IAAGV5xsN3Qq6hnzDOw3dC9owp/snDd0Ja6hrly8N3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"index\":[0,1,2,3,4],\"start_time\":{\"__ndarray__\":\"AGDqTGnDd0IAAGV5xsN3Qq6hH6BMv3dC9oyh07jDd0Ja6nIQdsN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]}},\"selected\":{\"id\":\"2489\"},\"selection_policy\":{\"id\":\"2490\"}},\"id\":\"2426\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"children\":[{\"id\":\"2364\"},{\"id\":\"2407\"}]},\"id\":\"2439\",\"type\":\"Column\"},{\"attributes\":{},\"id\":\"2442\",\"type\":\"AllLabels\"},{\"attributes\":{\"data_source\":{\"id\":\"2426\"},\"glyph\":{\"id\":\"2428\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2429\"},\"view\":{\"id\":\"2431\"}},\"id\":\"2430\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"2492\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"2494\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"blue\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"blue\"},\"x\":{\"field\":\"StartTime\"},\"y\":{\"field\":\"Row\"}},\"id\":\"2429\",\"type\":\"Circle\"},{\"attributes\":{\"data\":{\"Center\":{\"__ndarray__\":\"WurG+qDDd0IAAGV5xsN3Qq6hX2iNwXdCAHBfX5nDd0L2jOVowcN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"Name\":[\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"naebofkqlmonbrmloaonffmdjipln\",\"qdbbijed\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\"],\"Row\":[0,1,2,3,4],\"Width\":{\"__ndarray__\":\"AAAAACp1lUEAAAAAAAAAAAAAAABCBtJBAAAAiDoJmEEAAAAAiCpxQQ==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"end_time\":{\"__ndarray__\":\"Wuoa5cvDd0IAAGV5xsN3Qq6hnzDOw3dCAIDUccnDd0L2jCn+ycN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"index\":[0,1,2,3,4],\"start_time\":{\"__ndarray__\":\"WupyEHbDd0IAAGV5xsN3Qq6hH6BMv3dCAGDqTGnDd0L2jKHTuMN3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]}},\"selected\":{\"id\":\"2472\"},\"selection_policy\":{\"id\":\"2473\"}},\"id\":\"2361\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"2495\",\"type\":\"DaysTicker\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"2499\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"2497\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"blue\"},\"line_color\":{\"value\":\"blue\"},\"x\":{\"field\":\"StartTime\"},\"y\":{\"field\":\"Row\"}},\"id\":\"2428\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"2496\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"2426\"}},\"id\":\"2431\",\"type\":\"CDSView\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"2498\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":5},\"x\":{\"field\":\"StartTime\"},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2401\"}}},\"id\":\"2404\",\"type\":\"Scatter\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@end_time\":\"datetime\",\"@start_time\":\"datetime\"},\"tooltips\":[[\"Name\",\"@Name\"],[\"start_time\",\"@start_time{%F %T.%3N}\"],[\"end_time\",\"@end_time{%F %T.%3N}\"],[\"Name\",\"@Name\"],[\"Description\",\"@Description\"],[\"Type\",\"@Type\"],[\"TimeGenerated\",\"@TimeGenerated\"]]},\"id\":\"2363\",\"type\":\"HoverTool\"},{\"attributes\":{\"data_source\":{\"id\":\"2361\"},\"glyph\":{\"id\":\"2397\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2398\"},\"view\":{\"id\":\"2400\"}},\"id\":\"2399\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"2371\",\"type\":\"LinearScale\"},{\"attributes\":{\"range\":null,\"value\":0.5},\"id\":\"2401\",\"type\":\"Dodge\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"2382\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"2380\",\"type\":\"CategoricalTicker\"},{\"attributes\":{},\"id\":\"2373\",\"type\":\"CategoricalScale\"},{\"attributes\":{},\"id\":\"2450\",\"type\":\"NodesOnly\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"height\":{\"value\":0.3},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"width\":{\"field\":\"Width\"},\"x\":{\"field\":\"Center\"},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2395\"}}},\"id\":\"2398\",\"type\":\"Rect\"},{\"attributes\":{},\"id\":\"2449\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"2384\",\"type\":\"ResetTool\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"2363\"},{\"id\":\"2382\"},{\"id\":\"2383\"},{\"id\":\"2384\"},{\"id\":\"2385\"},{\"id\":\"2386\"}]},\"id\":\"2388\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"2443\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"source\":{\"id\":\"2361\"}},\"id\":\"2400\",\"type\":\"CDSView\"},{\"attributes\":{\"below\":[{\"id\":\"2311\"}],\"center\":[{\"id\":\"2314\"},{\"id\":\"2318\"},{\"id\":\"2350\"},{\"id\":\"2351\"},{\"id\":\"2352\"},{\"id\":\"2353\"},{\"id\":\"2354\"},{\"id\":\"2355\"},{\"id\":\"2356\"},{\"id\":\"2357\"},{\"id\":\"2358\"},{\"id\":\"2359\"}],\"height\":800,\"left\":[{\"id\":\"2315\"}],\"renderers\":[{\"id\":\"2335\"}],\"title\":{\"id\":\"2301\"},\"toolbar\":{\"id\":\"2326\"},\"width\":800,\"x_range\":{\"id\":\"2303\"},\"x_scale\":{\"id\":\"2307\"},\"y_range\":{\"id\":\"2305\"},\"y_scale\":{\"id\":\"2309\"}},\"id\":\"2300\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"overlay\":{\"id\":\"2387\"}},\"id\":\"2383\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"data_source\":{\"id\":\"2362\"},\"glyph\":{\"id\":\"2403\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2404\"},\"view\":{\"id\":\"2406\"}},\"id\":\"2405\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"2342\"},\"inspection_policy\":{\"id\":\"2449\"},\"layout_provider\":{\"id\":\"2344\"},\"node_renderer\":{\"id\":\"2338\"},\"selection_policy\":{\"id\":\"2450\"}},\"id\":\"2335\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"2386\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"2385\",\"type\":\"SaveTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"navy\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":5},\"x\":{\"field\":\"StartTime\"},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2401\"}}},\"id\":\"2403\",\"type\":\"Scatter\"},{\"attributes\":{},\"id\":\"2461\",\"type\":\"AllLabels\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"2437\"},\"major_label_policy\":{\"id\":\"2464\"},\"ticker\":{\"id\":\"2376\"}},\"id\":\"2375\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"axis\":{\"id\":\"2379\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"2381\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"2462\",\"type\":\"CategoricalTickFormatter\"},{\"attributes\":{\"axis_label\":\"Name\",\"formatter\":{\"id\":\"2462\"},\"major_label_policy\":{\"id\":\"2461\"},\"ticker\":{\"id\":\"2380\"}},\"id\":\"2379\",\"type\":\"CategoricalAxis\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"2477\"},{\"id\":\"2478\"},{\"id\":\"2479\"},{\"id\":\"2480\"},{\"id\":\"2481\"},{\"id\":\"2482\"},{\"id\":\"2483\"},{\"id\":\"2484\"},{\"id\":\"2485\"},{\"id\":\"2486\"},{\"id\":\"2487\"},{\"id\":\"2488\"}]},\"id\":\"2376\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2375\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"2378\",\"type\":\"Grid\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.4},\"fill_color\":{\"value\":\"navy\"},\"height\":{\"value\":0.3},\"line_color\":{\"value\":\"navy\"},\"width\":{\"field\":\"Width\"},\"x\":{\"field\":\"Center\"},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2395\"}}},\"id\":\"2397\",\"type\":\"Rect\"},{\"attributes\":{\"factors\":[\"ecfclmeoanpmiadpfakedjrneofreeoqlmalrdbopjomadpabrccoaklapbbffje\",\"mmejikifrklncqnamleekfcnmdmfqfrcelcbkbcdbmlrekcloppeeela\",\"naebofkqlmonbrmloaonffmdjipln\",\"qdbbijed\",\"qmlcpkdleidqcpqonpcboelqmdcdkjbmnqdnp\"]},\"id\":\"2369\",\"type\":\"FactorRange\"},{\"attributes\":{\"text\":\"Timeline: Entity Timeline\"},\"id\":\"2365\",\"type\":\"Title\"},{\"attributes\":{\"end\":1633230044666.106,\"start\":1631778524666.106},\"id\":\"2367\",\"type\":\"Range1d\"},{\"attributes\":{\"range\":null,\"value\":0.5},\"id\":\"2395\",\"type\":\"Dodge\"},{\"attributes\":{},\"id\":\"2464\",\"type\":\"AllLabels\"},{\"attributes\":{\"below\":[{\"id\":\"2375\"}],\"center\":[{\"id\":\"2378\"},{\"id\":\"2381\"}],\"height\":300,\"left\":[{\"id\":\"2379\"}],\"min_border_left\":50,\"renderers\":[{\"id\":\"2399\"},{\"id\":\"2405\"}],\"title\":{\"id\":\"2365\"},\"toolbar\":{\"id\":\"2388\"},\"width\":800,\"x_range\":{\"id\":\"2367\"},\"x_scale\":{\"id\":\"2371\"},\"y_range\":{\"id\":\"2369\"},\"y_scale\":{\"id\":\"2373\"}},\"id\":\"2364\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"2333\",\"type\":\"HoverTool\"}],\"root_ids\":[\"2440\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"f6abf2b1-c950-4a4d-998e-5ea6704b3506\",\"root_ids\":[\"2440\"],\"roots\":{\"2440\":\"161010f6-3f0f-4ea7-a749-7b44d390299e\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "2440"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.models.layouts.Column\">Column</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'2440', <span id=\"2832\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">children&nbsp;=&nbsp;[Figure(id='2300', ...), Column(id='2439', ...)],</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">rows&nbsp;=&nbsp;'auto',</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">spacing&nbsp;=&nbsp;0,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;None,</div></div><div class=\"2831\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto')</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"2832\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"2831\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Column(id='2440', ...)"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_graph.plot_with_timeline()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Adding and Removing Entities\n",
    "\n",
    "During an investigation, you will want to expand or collapse the graph based on the outcomes of your investigations. The EntityGraph supports the ability to add and remove entities from the graph during the investigation. \n",
    "Entities that are added with the `add_entity` or `add_incident` functions, depending on whether the item being added is an incident or an entity. Added entities can be attached to another entity in the graph by specifying the name of the entity to attach to with the `attached_to` parameter."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"3387\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"3387\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"3387\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"3388\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"3388\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"3388\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"cdbacdd2-a606-4b48-83ae-6a0568ac312b\" data-root-id=\"3389\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"d39085d9-ea3c-4326-a7fb-95877a94d733\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"3400\"}],\"center\":[{\"id\":\"3403\"},{\"id\":\"3407\"},{\"id\":\"3439\"},{\"id\":\"3440\"},{\"id\":\"3441\"},{\"id\":\"3442\"},{\"id\":\"3443\"}],\"height\":800,\"left\":[{\"id\":\"3404\"}],\"renderers\":[{\"id\":\"3424\"}],\"title\":{\"id\":\"3390\"},\"toolbar\":{\"id\":\"3415\"},\"width\":800,\"x_range\":{\"id\":\"3392\"},\"x_scale\":{\"id\":\"3396\"},\"y_range\":{\"id\":\"3394\"},\"y_scale\":{\"id\":\"3398\"}},\"id\":\"3389\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"text\":\"www.contoso.com\",\"text_font_size\":\"10pt\",\"x\":1.5474765760741906,\"x_offset\":5,\"y\":2.0,\"y_offset\":5},\"id\":\"3443\",\"type\":\"Label\"},{\"attributes\":{\"formatter\":{\"id\":\"3566\"},\"major_label_policy\":{\"id\":\"3565\"},\"ticker\":{\"id\":\"3401\"}},\"id\":\"3400\",\"type\":\"LinearAxis\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"3414\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"3434\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"3396\",\"type\":\"LinearScale\"},{\"attributes\":{\"text\":\"demo\",\"text_font_size\":\"10pt\",\"x\":0.6713871059158802,\"x_offset\":5,\"y\":0.8635038218640325,\"y_offset\":5},\"id\":\"3441\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"3413\",\"type\":\"HelpTool\"},{\"attributes\":{},\"id\":\"3401\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"3405\",\"type\":\"BasicTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3404\"},\"dimension\":1,\"ticker\":null},\"id\":\"3407\",\"type\":\"Grid\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"3394\",\"type\":\"Range1d\"},{\"attributes\":{\"formatter\":{\"id\":\"3553\"},\"major_label_policy\":{\"id\":\"3552\"},\"ticker\":{\"id\":\"3405\"}},\"id\":\"3404\",\"type\":\"LinearAxis\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"3390\",\"type\":\"Title\"},{\"attributes\":{\"axis\":{\"id\":\"3400\"},\"ticker\":null},\"id\":\"3403\",\"type\":\"Grid\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"3392\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"3569\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"3398\",\"type\":\"LinearScale\"},{\"attributes\":{\"data_source\":{\"id\":\"3426\"},\"glyph\":{\"id\":\"3434\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"3428\"}},\"id\":\"3427\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3570\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"CONTOSO\\\\auser\",\"text_font_size\":\"10pt\",\"x\":-1.816494482163167,\"x_offset\":5,\"y\":-0.5206325212562211,\"y_offset\":5},\"id\":\"3442\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"text_font_size\":\"10pt\",\"x\":-0.04860716703159008,\"x_offset\":5,\"y\":-1.8883686440287462,\"y_offset\":5},\"id\":\"3440\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"3552\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"3409\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"3408\"},{\"id\":\"3409\"},{\"id\":\"3410\"},{\"id\":\"3411\"},{\"id\":\"3412\"},{\"id\":\"3413\"},{\"id\":\"3422\"}]},\"id\":\"3415\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"3553\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"3408\",\"type\":\"PanTool\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"3422\",\"type\":\"HoverTool\"},{\"attributes\":{\"overlay\":{\"id\":\"3414\"}},\"id\":\"3410\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"3411\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"3429\",\"type\":\"MultiLine\"},{\"attributes\":{},\"id\":\"3412\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"3571\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"3560\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"3572\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"demo\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"start\":[\"Incident: Sample Incident\",\"Incident: Sample Incident\",\"Incident: Sample Incident\",\"demo\"]},\"selected\":{\"id\":\"3571\"},\"selection_policy\":{\"id\":\"3572\"}},\"id\":\"3430\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3559\",\"type\":\"NodesOnly\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"orange\",\"green\",\"green\",\"green\"],\"description\":[\"2021-09-22T15:09:09.2786667Z - Sample Incident - 123\",\"User Added to Priviledged Group in CONTOSO Domain - ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5']\",\"demo.demo.contoso.com (OSFamily.Windows)\",null,\"www.contoso.com\"],\"end_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null,null],\"entitytype\":[\"incident\",\"alert\",\"host\",\"account\",\"url\"],\"index\":[\"Incident: Sample Incident\",\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"demo\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"name\":[\"Sample Incident\",\"User Added to Priviledged Group in CONTOSO Domain\",\"demo\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"node_color\":[\"red\",\"orange\",\"green\",\"green\",\"green\"],\"node_type\":[\"incident\",\"alert\",\"entity\",\"entity\",\"entity\"],\"source\":[null,\"{ 'AdditionalData': { 'ID': '8b7d06d8-dbae-4b23-87ed-1a27b75437d5',\\n                      'Name': 'User Added to Priviledged Group in CONTOSO Domain'},\\n  'DisplayName': 'User Added to Priviledged Group in CONTOSO Domain',\\n  'SystemAlertIds': ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5'],\\n  'Type': 'alerts',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'DnsDomain': 'demo.contoso.com',\\n  'HostName': 'demo',\\n  'IsDomainJoined': False,\\n  'NetBiosName': 'demo',\\n  'OSFamily': <OSFamily.Windows: 1>,\\n  'Type': 'host',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'DisplayName': 'CONTOSO\\\\\\\\auser',\\n  'IsDomainJoined': False,\\n  'Type': 'account',\\n  'edges': set()}\",\"{'AdditionalData': {}, 'Type': 'url', 'Url': 'www.contoso.com', 'edges': set()}\"],\"start_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null,null],\"time_generated\":[\"2021-09-22T15:09:09.2786667Z\",null,null,null,null]},\"selected\":{\"id\":\"3569\"},\"selection_policy\":{\"id\":\"3570\"}},\"id\":\"3426\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"3426\"}},\"id\":\"3428\",\"type\":\"CDSView\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"3431\"},\"inspection_policy\":{\"id\":\"3559\"},\"layout_provider\":{\"id\":\"3433\"},\"node_renderer\":{\"id\":\"3427\"},\"selection_policy\":{\"id\":\"3560\"}},\"id\":\"3424\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"graph_layout\":{\"Alert: User Added to Priviledged Group in CONTOSO Domain\":[-0.04860716703159008,-1.8883686440287462],\"CONTOSO\\\\auser\":[-1.816494482163167,-0.5206325212562211],\"Incident: Sample Incident\":[-0.353762032795313,-0.4545026565790653],\"demo\":[0.6713871059158802,0.8635038218640325],\"www.contoso.com\":[1.5474765760741906,2.0]}},\"id\":\"3433\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{\"data_source\":{\"id\":\"3430\"},\"glyph\":{\"id\":\"3429\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"3432\"}},\"id\":\"3431\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3565\",\"type\":\"AllLabels\"},{\"attributes\":{\"source\":{\"id\":\"3430\"}},\"id\":\"3432\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"3566\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"text\":\"Incident: Sample Incident\",\"text_font_size\":\"10pt\",\"x\":-0.353762032795313,\"x_offset\":5,\"y\":-0.4545026565790653,\"y_offset\":5},\"id\":\"3439\",\"type\":\"Label\"}],\"root_ids\":[\"3389\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"d39085d9-ea3c-4326-a7fb-95877a94d733\",\"root_ids\":[\"3389\"],\"roots\":{\"3389\":\"cdbacdd2-a606-4b48-83ae-6a0568ac312b\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "3389"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'3389', <span id=\"3696\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='3400', ...)],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='3403', ...), Grid(id='3407', ...), Label(id='3439', ...), Label(id='3440', ...), Label(id='3441', ...), Label(id='3442', ...), Label(id='3443', ...)],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='3404', ...)],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='3424', ...)],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='3390', ...),</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='3415', ...),</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='3392', ...),</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='3396', ...),</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='3394', ...),</div></div><div class=\"3695\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='3398', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"3696\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"3695\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='3389', ...)"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "url_ent = Url(Url=\"www.contoso.com\")\n",
    "graph = EntityGraph(incident)\n",
    "graph.add_entity(url_ent, attached_to=\"demo\")\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Removing a entity from the graph is done with `remove_node` function, with the name of the entity to remove passed with the `name` parameter:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"3698\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"3698\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"3698\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"c94a2091-15c7-4c43-9d05-91e0d2ee59d8\" data-root-id=\"3699\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"26f4f02f-80da-4c93-a33e-ba195f9be9ff\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"3710\"}],\"center\":[{\"id\":\"3713\"},{\"id\":\"3717\"},{\"id\":\"3749\"},{\"id\":\"3750\"},{\"id\":\"3751\"},{\"id\":\"3752\"}],\"height\":800,\"left\":[{\"id\":\"3714\"}],\"renderers\":[{\"id\":\"3734\"}],\"title\":{\"id\":\"3700\"},\"toolbar\":{\"id\":\"3725\"},\"width\":800,\"x_range\":{\"id\":\"3702\"},\"x_scale\":{\"id\":\"3706\"},\"y_range\":{\"id\":\"3704\"},\"y_scale\":{\"id\":\"3708\"}},\"id\":\"3699\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"formatter\":{\"id\":\"3884\"},\"major_label_policy\":{\"id\":\"3883\"},\"ticker\":{\"id\":\"3715\"}},\"id\":\"3714\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"3706\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"3708\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"3900\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"3711\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"3901\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"3718\",\"type\":\"PanTool\"},{\"attributes\":{\"axis\":{\"id\":\"3710\"},\"ticker\":null},\"id\":\"3713\",\"type\":\"Grid\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"3718\"},{\"id\":\"3719\"},{\"id\":\"3720\"},{\"id\":\"3721\"},{\"id\":\"3722\"},{\"id\":\"3723\"},{\"id\":\"3732\"}]},\"id\":\"3725\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"3719\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"3741\"},\"inspection_policy\":{\"id\":\"3890\"},\"layout_provider\":{\"id\":\"3743\"},\"node_renderer\":{\"id\":\"3737\"},\"selection_policy\":{\"id\":\"3891\"}},\"id\":\"3734\",\"type\":\"GraphRenderer\"},{\"attributes\":{},\"id\":\"3883\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"3722\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"3884\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"3702\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"3902\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"3891\",\"type\":\"NodesOnly\"},{\"attributes\":{\"graph_layout\":{\"Alert: User Added to Priviledged Group in CONTOSO Domain\":[0.7395680708745855,0.198605324662098],\"CONTOSO\\\\auser\":[0.618298761991292,-0.6731097576385419],\"Incident: Sample Incident\":[0.6421331671341234,-0.23122905556145373],\"www.contoso.com\":[-2.0,0.7057334885378975]}},\"id\":\"3743\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{\"axis\":{\"id\":\"3714\"},\"dimension\":1,\"ticker\":null},\"id\":\"3717\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"3721\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"3903\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"3890\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"3723\",\"type\":\"HelpTool\"},{\"attributes\":{\"data_source\":{\"id\":\"3736\"},\"glyph\":{\"id\":\"3744\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"3738\"}},\"id\":\"3737\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"3724\"}},\"id\":\"3720\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"source\":{\"id\":\"3736\"}},\"id\":\"3738\",\"type\":\"CDSView\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"3732\",\"type\":\"HoverTool\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"orange\",\"green\",\"green\"],\"description\":[\"2021-09-22T15:09:09.2786667Z - Sample Incident - 123\",\"User Added to Priviledged Group in CONTOSO Domain - ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5']\",null,\"www.contoso.com\"],\"end_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null],\"entitytype\":[\"incident\",\"alert\",\"account\",\"url\"],\"index\":[\"Incident: Sample Incident\",\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"name\":[\"Sample Incident\",\"User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"node_color\":[\"red\",\"orange\",\"green\",\"green\"],\"node_type\":[\"incident\",\"alert\",\"entity\",\"entity\"],\"source\":[null,\"{ 'AdditionalData': { 'ID': '8b7d06d8-dbae-4b23-87ed-1a27b75437d5',\\n                      'Name': 'User Added to Priviledged Group in CONTOSO Domain'},\\n  'DisplayName': 'User Added to Priviledged Group in CONTOSO Domain',\\n  'SystemAlertIds': ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5'],\\n  'Type': 'alerts',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'DisplayName': 'CONTOSO\\\\\\\\auser',\\n  'IsDomainJoined': False,\\n  'Type': 'account',\\n  'edges': set()}\",\"{'AdditionalData': {}, 'Type': 'url', 'Url': 'www.contoso.com', 'edges': set()}\"],\"start_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null],\"time_generated\":[\"2021-09-22T15:09:09.2786667Z\",null,null,null]},\"selected\":{\"id\":\"3900\"},\"selection_policy\":{\"id\":\"3901\"}},\"id\":\"3736\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3739\",\"type\":\"MultiLine\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\"],\"start\":[\"Incident: Sample Incident\",\"Incident: Sample Incident\"]},\"selected\":{\"id\":\"3902\"},\"selection_policy\":{\"id\":\"3903\"}},\"id\":\"3740\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3896\",\"type\":\"AllLabels\"},{\"attributes\":{\"data_source\":{\"id\":\"3740\"},\"glyph\":{\"id\":\"3739\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"3742\"}},\"id\":\"3741\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"3740\"}},\"id\":\"3742\",\"type\":\"CDSView\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"3704\",\"type\":\"Range1d\"},{\"attributes\":{\"formatter\":{\"id\":\"3897\"},\"major_label_policy\":{\"id\":\"3896\"},\"ticker\":{\"id\":\"3711\"}},\"id\":\"3710\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"3897\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"text\":\"www.contoso.com\",\"text_font_size\":\"10pt\",\"x\":-2.0,\"x_offset\":5,\"y\":0.7057334885378975,\"y_offset\":5},\"id\":\"3752\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"3715\",\"type\":\"BasicTicker\"},{\"attributes\":{\"text\":\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"text_font_size\":\"10pt\",\"x\":0.7395680708745855,\"x_offset\":5,\"y\":0.198605324662098,\"y_offset\":5},\"id\":\"3750\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"CONTOSO\\\\auser\",\"text_font_size\":\"10pt\",\"x\":0.618298761991292,\"x_offset\":5,\"y\":-0.6731097576385419,\"y_offset\":5},\"id\":\"3751\",\"type\":\"Label\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"3724\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"3700\",\"type\":\"Title\"},{\"attributes\":{\"text\":\"Incident: Sample Incident\",\"text_font_size\":\"10pt\",\"x\":0.6421331671341234,\"x_offset\":5,\"y\":-0.23122905556145373,\"y_offset\":5},\"id\":\"3749\",\"type\":\"Label\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"3744\",\"type\":\"Circle\"}],\"root_ids\":[\"3699\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"26f4f02f-80da-4c93-a33e-ba195f9be9ff\",\"root_ids\":[\"3699\"],\"roots\":{\"3699\":\"c94a2091-15c7-4c43-9d05-91e0d2ee59d8\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "3699"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'3699', <span id=\"4027\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='3710', ...)],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='3713', ...), Grid(id='3717', ...), Label(id='3749', ...), Label(id='3750', ...), Label(id='3751', ...), Label(id='3752', ...)],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='3714', ...)],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='3734', ...)],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='3700', ...),</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='3725', ...),</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='3702', ...),</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='3706', ...),</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='3704', ...),</div></div><div class=\"4026\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='3708', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"4027\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"4026\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='3699', ...)"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "graph.remove_node(\"demo\")\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Adding & Removing Links Between Entities\n",
    "\n",
    "As well as adding entities to the graph you will also want to update the links between them as an investigation progresses. This can be done with the `add_link` and `remove_link` functions:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"4757\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"4757\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"4757\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"51c797e0-cdae-4cc2-b684-d8a7c6ea01d2\" data-root-id=\"4758\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"1fada6d0-fa85-4099-a502-97df53ca47e7\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"4769\"}],\"center\":[{\"id\":\"4772\"},{\"id\":\"4776\"},{\"id\":\"4808\"},{\"id\":\"4809\"},{\"id\":\"4810\"},{\"id\":\"4811\"}],\"height\":800,\"left\":[{\"id\":\"4773\"}],\"renderers\":[{\"id\":\"4793\"}],\"title\":{\"id\":\"4759\"},\"toolbar\":{\"id\":\"4784\"},\"width\":800,\"x_range\":{\"id\":\"4761\"},\"x_scale\":{\"id\":\"4765\"},\"y_range\":{\"id\":\"4763\"},\"y_scale\":{\"id\":\"4767\"}},\"id\":\"4758\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"4803\",\"type\":\"Circle\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"4791\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"4767\",\"type\":\"LinearScale\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"4763\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"4765\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"5025\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"4782\",\"type\":\"HelpTool\"},{\"attributes\":{\"text\":\"www.contoso.com\",\"text_font_size\":\"10pt\",\"x\":-0.7051178209330256,\"x_offset\":5,\"y\":-0.2389647836180562,\"y_offset\":5},\"id\":\"4811\",\"type\":\"Label\"},{\"attributes\":{\"formatter\":{\"id\":\"5022\"},\"major_label_policy\":{\"id\":\"5021\"},\"ticker\":{\"id\":\"4770\"}},\"id\":\"4769\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"5026\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"4774\",\"type\":\"BasicTicker\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"4761\",\"type\":\"Range1d\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"4777\"},{\"id\":\"4778\"},{\"id\":\"4779\"},{\"id\":\"4780\"},{\"id\":\"4781\"},{\"id\":\"4782\"},{\"id\":\"4791\"}]},\"id\":\"4784\",\"type\":\"Toolbar\"},{\"attributes\":{\"graph_layout\":{\"Alert: User Added to Priviledged Group in CONTOSO Domain\":[1.9977699864667051,0.6770116506606975],\"CONTOSO\\\\auser\":[-2.0,-0.6777277366197544],\"Incident: Sample Incident\":[0.7073478344663202,0.2396808695771133],\"www.contoso.com\":[-0.7051178209330256,-0.2389647836180562]}},\"id\":\"4802\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{},\"id\":\"4778\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"4777\",\"type\":\"PanTool\"},{\"attributes\":{\"data_source\":{\"id\":\"4795\"},\"glyph\":{\"id\":\"4803\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"4797\"}},\"id\":\"4796\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"4783\"}},\"id\":\"4779\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"source\":{\"id\":\"4795\"}},\"id\":\"4797\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"4780\",\"type\":\"SaveTool\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"orange\",\"green\",\"green\"],\"description\":[\"2021-09-22T15:09:09.2786667Z - Sample Incident - 123\",\"User Added to Priviledged Group in CONTOSO Domain - ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5']\",null,\"www.contoso.com\"],\"end_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null],\"entitytype\":[\"incident\",\"alert\",\"account\",\"url\"],\"index\":[\"Incident: Sample Incident\",\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"name\":[\"Sample Incident\",\"User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\",\"www.contoso.com\"],\"node_color\":[\"red\",\"orange\",\"green\",\"green\"],\"node_type\":[\"incident\",\"alert\",\"entity\",\"entity\"],\"source\":[null,\"{ 'AdditionalData': { 'ID': '8b7d06d8-dbae-4b23-87ed-1a27b75437d5',\\n                      'Name': 'User Added to Priviledged Group in CONTOSO Domain'},\\n  'DisplayName': 'User Added to Priviledged Group in CONTOSO Domain',\\n  'SystemAlertIds': ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5'],\\n  'Type': 'alerts',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'DisplayName': 'CONTOSO\\\\\\\\auser',\\n  'IsDomainJoined': False,\\n  'Type': 'account',\\n  'edges': set()}\",\"{'AdditionalData': {}, 'Type': 'url', 'Url': 'www.contoso.com', 'edges': set()}\"],\"start_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null],\"time_generated\":[\"2021-09-22T15:09:09.2786667Z\",null,null,null]},\"selected\":{\"id\":\"5025\"},\"selection_policy\":{\"id\":\"5026\"}},\"id\":\"4795\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"4781\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"4798\",\"type\":\"MultiLine\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"www.contoso.com\",\"www.contoso.com\"],\"start\":[\"Incident: Sample Incident\",\"Incident: Sample Incident\",\"CONTOSO\\\\auser\"]},\"selected\":{\"id\":\"5027\"},\"selection_policy\":{\"id\":\"5028\"}},\"id\":\"4799\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"5027\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"4799\"},\"glyph\":{\"id\":\"4798\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"4801\"}},\"id\":\"4800\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"5028\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"5015\",\"type\":\"NodesOnly\"},{\"attributes\":{\"source\":{\"id\":\"4799\"}},\"id\":\"4801\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"text_font_size\":\"10pt\",\"x\":1.9977699864667051,\"x_offset\":5,\"y\":0.6770116506606975,\"y_offset\":5},\"id\":\"4809\",\"type\":\"Label\"},{\"attributes\":{\"axis\":{\"id\":\"4769\"},\"ticker\":null},\"id\":\"4772\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"5021\",\"type\":\"AllLabels\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"4800\"},\"inspection_policy\":{\"id\":\"5015\"},\"layout_provider\":{\"id\":\"4802\"},\"node_renderer\":{\"id\":\"4796\"},\"selection_policy\":{\"id\":\"5016\"}},\"id\":\"4793\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"text\":\"CONTOSO\\\\auser\",\"text_font_size\":\"10pt\",\"x\":-2.0,\"x_offset\":5,\"y\":-0.6777277366197544,\"y_offset\":5},\"id\":\"4810\",\"type\":\"Label\"},{\"attributes\":{\"formatter\":{\"id\":\"5009\"},\"major_label_policy\":{\"id\":\"5008\"},\"ticker\":{\"id\":\"4774\"}},\"id\":\"4773\",\"type\":\"LinearAxis\"},{\"attributes\":{\"axis\":{\"id\":\"4773\"},\"dimension\":1,\"ticker\":null},\"id\":\"4776\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"5016\",\"type\":\"NodesOnly\"},{\"attributes\":{\"text\":\"Incident: Sample Incident\",\"text_font_size\":\"10pt\",\"x\":0.7073478344663202,\"x_offset\":5,\"y\":0.2396808695771133,\"y_offset\":5},\"id\":\"4808\",\"type\":\"Label\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"4783\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"4770\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"5022\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"5008\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"5009\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"4759\",\"type\":\"Title\"}],\"root_ids\":[\"4758\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"1fada6d0-fa85-4099-a502-97df53ca47e7\",\"root_ids\":[\"4758\"],\"roots\":{\"4758\":\"51c797e0-cdae-4cc2-b684-d8a7c6ea01d2\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "4758"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'4758', <span id=\"5152\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='4769', ...)],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='4772', ...), Grid(id='4776', ...), Label(id='4808', ...), Label(id='4809', ...), Label(id='4810', ...), Label(id='4811', ...)],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='4773', ...)],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='4793', ...)],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='4759', ...),</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='4784', ...),</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='4761', ...),</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='4765', ...),</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='4763', ...),</div></div><div class=\"5151\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='4767', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"5152\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"5151\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='4758', ...)"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "graph.add_link(\"www.contoso.com\", \"Incident: Sample Incident\")\n",
    "graph.add_link(\"www.contoso.com\", \"CONTOSO\\\\auser\")\n",
    "graph.remove_link(\"CONTOSO\\\\auser\", \"Incident: Sample Incident\")\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Adding Notes\n",
    "\n",
    "Entities are not the only elements that you might want to record as part of an investigation. To include a wide range of other items and observations the EntityGraph has the concept of Notes. Notes are nodes in the graph that have free form titles and descriptions, allowing the user to add anything they need - be it a comment on an entity on the graph, or a query used to find an event.\n",
    "Notes area added with the `add_note` function. As with the `add_entity` function notes can be attached to an existing entity in the graph. In addition, you can adjust the color of the node added to the graph, and add a username associated with the note."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"6016\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"6016\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\": \"dM3QQsP+wXdHg42wTqW85BjZQdLNNIXqlPw/BgKoExPmTG7ZLML4EGqLMfqHT6ON\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\": \"8x57I4YuIfu8XyZfFo0XVr2WAT8EK4rh/uDe3wF7YuW2FNUSNEpJbsPaB1nJ2fz2\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\": \"3QTqdz9LyAm2i0sG5XTePsHec3UHWwVsrOL68SYRoAXsafvfAyqtQ+h440+qIBhS\"};\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.3.3.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.3.3.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"6016\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"f3075cff-6098-4bad-b1c8-4c94bddb3b13\" data-root-id=\"6017\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"9a0e79a1-e492-4309-89f5-99a7d9967855\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"6028\"}],\"center\":[{\"id\":\"6031\"},{\"id\":\"6035\"},{\"id\":\"6067\"},{\"id\":\"6068\"},{\"id\":\"6069\"},{\"id\":\"6070\"},{\"id\":\"6071\"}],\"height\":800,\"left\":[{\"id\":\"6032\"}],\"renderers\":[{\"id\":\"6052\"}],\"title\":{\"id\":\"6018\"},\"toolbar\":{\"id\":\"6043\"},\"width\":800,\"x_range\":{\"id\":\"6020\"},\"x_scale\":{\"id\":\"6024\"},\"y_range\":{\"id\":\"6022\"},\"y_scale\":{\"id\":\"6026\"}},\"id\":\"6017\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{},\"id\":\"6040\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"6057\",\"type\":\"MultiLine\"},{\"attributes\":{},\"id\":\"6037\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"formatter\":{\"id\":\"6348\"},\"major_label_policy\":{\"id\":\"6347\"},\"ticker\":{\"id\":\"6029\"}},\"id\":\"6028\",\"type\":\"LinearAxis\"},{\"attributes\":{\"data_source\":{\"id\":\"6054\"},\"glyph\":{\"id\":\"6062\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"6056\"}},\"id\":\"6055\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"end\":[\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"www.contoso.com\",\"This is a note\",\"www.contoso.com\"],\"start\":[\"Incident: Sample Incident\",\"Incident: Sample Incident\",\"Incident: Sample Incident\",\"CONTOSO\\\\auser\"]},\"selected\":{\"id\":\"6353\"},\"selection_policy\":{\"id\":\"6354\"}},\"id\":\"6058\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"6059\"},\"inspection_policy\":{\"id\":\"6341\"},\"layout_provider\":{\"id\":\"6061\"},\"node_renderer\":{\"id\":\"6055\"},\"selection_policy\":{\"id\":\"6342\"}},\"id\":\"6052\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"orange\",\"green\",\"green\",\"purple\"],\"description\":[\"2021-09-22T15:09:09.2786667Z - Sample Incident - 123\",\"User Added to Priviledged Group in CONTOSO Domain - ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5']\",null,\"www.contoso.com\",\"Notes allow for free form additions to the graph\"],\"end_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null,null],\"entitytype\":[\"incident\",\"alert\",\"account\",\"url\",null],\"index\":[\"Incident: Sample Incident\",\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\",\"www.contoso.com\",\"This is a note\"],\"name\":[\"Sample Incident\",\"User Added to Priviledged Group in CONTOSO Domain\",\"CONTOSO\\\\auser\",\"www.contoso.com\",\"This is a note\"],\"node_color\":[\"red\",\"orange\",\"green\",\"green\",\"purple\"],\"node_type\":[\"incident\",\"alert\",\"entity\",\"entity\",\"analystnote\"],\"source\":[null,\"{ 'AdditionalData': { 'ID': '8b7d06d8-dbae-4b23-87ed-1a27b75437d5',\\n                      'Name': 'User Added to Priviledged Group in CONTOSO Domain'},\\n  'DisplayName': 'User Added to Priviledged Group in CONTOSO Domain',\\n  'SystemAlertIds': ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5'],\\n  'Type': 'alerts',\\n  'edges': set()}\",\"{ 'AdditionalData': {},\\n  'DisplayName': 'CONTOSO\\\\\\\\auser',\\n  'IsDomainJoined': False,\\n  'Type': 'account',\\n  'edges': set()}\",\"{'AdditionalData': {}, 'Type': 'url', 'Url': 'www.contoso.com', 'edges': set()}\",null],\"start_time\":[\"2021-09-22T14:39:24.04Z\",null,null,null,null],\"time_generated\":[\"2021-09-22T15:09:09.2786667Z\",null,null,null,1633511135203.6992],\"user\":[null,null,null,null,\"Analyst\"]},\"selected\":{\"id\":\"6351\"},\"selection_policy\":{\"id\":\"6352\"}},\"id\":\"6054\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"6054\"}},\"id\":\"6056\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"6041\",\"type\":\"HelpTool\"},{\"attributes\":{\"text\":\"Alert: User Added to Priviledged Group in CONTOSO Domain\",\"text_font_size\":\"10pt\",\"x\":0.9177961022982826,\"x_offset\":5,\"y\":1.2870327132688901,\"y_offset\":5},\"id\":\"6068\",\"type\":\"Label\"},{\"attributes\":{\"graph_layout\":{\"Alert: User Added to Priviledged Group in CONTOSO Domain\":[0.9177961022982826,1.2870327132688901],\"CONTOSO\\\\auser\":[-2.0,-0.6667110786659408],\"Incident: Sample Incident\":[0.4591238220909722,0.15657687078915353],\"This is a note\":[1.4932516813324899,-0.4896693052716502],\"www.contoso.com\":[-0.870171605721745,-0.2872292001204533]}},\"id\":\"6061\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{\"formatter\":{\"id\":\"6335\"},\"major_label_policy\":{\"id\":\"6334\"},\"ticker\":{\"id\":\"6033\"}},\"id\":\"6032\",\"type\":\"LinearAxis\"},{\"attributes\":{\"data_source\":{\"id\":\"6058\"},\"glyph\":{\"id\":\"6057\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"6060\"}},\"id\":\"6059\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"6353\",\"type\":\"Selection\"},{\"attributes\":{\"source\":{\"id\":\"6058\"}},\"id\":\"6060\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"6029\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"6354\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"www.contoso.com\",\"text_font_size\":\"10pt\",\"x\":-0.870171605721745,\"x_offset\":5,\"y\":-0.2872292001204533,\"y_offset\":5},\"id\":\"6070\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"6033\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"6026\",\"type\":\"LinearScale\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"6022\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"6347\",\"type\":\"AllLabels\"},{\"attributes\":{\"text\":\"CONTOSO\\\\auser\",\"text_font_size\":\"10pt\",\"x\":-2.0,\"x_offset\":5,\"y\":-0.6667110786659408,\"y_offset\":5},\"id\":\"6069\",\"type\":\"Label\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"6042\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"6341\",\"type\":\"NodesOnly\"},{\"attributes\":{\"text\":\"Incident: Sample Incident\",\"text_font_size\":\"10pt\",\"x\":0.4591238220909722,\"x_offset\":5,\"y\":0.15657687078915353,\"y_offset\":5},\"id\":\"6067\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"This is a note\",\"text_font_size\":\"10pt\",\"x\":1.4932516813324899,\"x_offset\":5,\"y\":-0.4896693052716502,\"y_offset\":5},\"id\":\"6071\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"6018\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"6342\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"6348\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"6351\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"6335\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"],[\"entitytype\",\"@entitytype\"]]},\"id\":\"6050\",\"type\":\"HoverTool\"},{\"attributes\":{\"axis\":{\"id\":\"6032\"},\"dimension\":1,\"ticker\":null},\"id\":\"6035\",\"type\":\"Grid\"},{\"attributes\":{\"axis\":{\"id\":\"6028\"},\"ticker\":null},\"id\":\"6031\",\"type\":\"Grid\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"6020\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"6334\",\"type\":\"AllLabels\"},{\"attributes\":{\"overlay\":{\"id\":\"6042\"}},\"id\":\"6038\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"6024\",\"type\":\"LinearScale\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"value\":25}},\"id\":\"6062\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"6039\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"6036\",\"type\":\"PanTool\"},{\"attributes\":{\"active_multi\":null,\"tools\":[{\"id\":\"6036\"},{\"id\":\"6037\"},{\"id\":\"6038\"},{\"id\":\"6039\"},{\"id\":\"6040\"},{\"id\":\"6041\"},{\"id\":\"6050\"}]},\"id\":\"6043\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"6352\",\"type\":\"UnionRenderers\"}],\"root_ids\":[\"6017\"]},\"title\":\"Bokeh Application\",\"version\":\"2.3.3\"}};\n  var render_items = [{\"docid\":\"9a0e79a1-e492-4309-89f5-99a7d9967855\",\"root_ids\":[\"6017\"],\"roots\":{\"6017\":\"f3075cff-6098-4bad-b1c8-4c94bddb3b13\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "6017"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.plotting.figure.Figure\">Figure</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'6017', <span id=\"6478\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">above&nbsp;=&nbsp;[],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_scale&nbsp;=&nbsp;1,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">below&nbsp;=&nbsp;[LinearAxis(id='6028', ...)],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">border_fill_color&nbsp;=&nbsp;'#ffffff',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">center&nbsp;=&nbsp;[Grid(id='6031', ...), Grid(id='6035', ...), Label(id='6067', ...), Label(id='6068', ...), Label(id='6069', ...), Label(id='6070', ...), Label(id='6071', ...)],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_x_ranges&nbsp;=&nbsp;{},</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">extra_y_ranges&nbsp;=&nbsp;{},</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_height&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">frame_width&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;800,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">hidpi&nbsp;=&nbsp;True,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_height&nbsp;=&nbsp;0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">inner_width&nbsp;=&nbsp;0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">left&nbsp;=&nbsp;[LinearAxis(id='6032', ...)],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_factor&nbsp;=&nbsp;10,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_interval&nbsp;=&nbsp;300,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_threshold&nbsp;=&nbsp;2000,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">lod_timeout&nbsp;=&nbsp;500,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">match_aspect&nbsp;=&nbsp;False,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border&nbsp;=&nbsp;5,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_bottom&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_left&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_right&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_border_top&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_height&nbsp;=&nbsp;0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outer_width&nbsp;=&nbsp;0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_alpha&nbsp;=&nbsp;1.0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_cap&nbsp;=&nbsp;'butt',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_color&nbsp;=&nbsp;'#e5e5e5',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash&nbsp;=&nbsp;[],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_dash_offset&nbsp;=&nbsp;0,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_join&nbsp;=&nbsp;'bevel',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">outline_line_width&nbsp;=&nbsp;1,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">output_backend&nbsp;=&nbsp;'canvas',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">renderers&nbsp;=&nbsp;[GraphRenderer(id='6052', ...)],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">reset_policy&nbsp;=&nbsp;'standard',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">right&nbsp;=&nbsp;[],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">syncable&nbsp;=&nbsp;True,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title&nbsp;=&nbsp;Title(id='6018', ...),</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">title_location&nbsp;=&nbsp;'above',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar&nbsp;=&nbsp;Toolbar(id='6043', ...),</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_location&nbsp;=&nbsp;'right',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">toolbar_sticky&nbsp;=&nbsp;True,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;800,</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_range&nbsp;=&nbsp;Range1d(id='6020', ...),</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">x_scale&nbsp;=&nbsp;LinearScale(id='6024', ...),</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_range&nbsp;=&nbsp;Range1d(id='6022', ...),</div></div><div class=\"6477\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">y_scale&nbsp;=&nbsp;LinearScale(id='6026', ...))</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"6478\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"6477\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n"
      ],
      "text/plain": [
       "Figure(id='6017', ...)"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "graph.add_note(name=\"This is a note\", \n",
    "    description=\"Notes allow for free form additions to the graph\", \n",
    "    attached_to=\"Incident: Sample Incident\")\n",
    "graph.plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Exporting to a DataFrame\n",
    "\n",
    "As a graph has been built up during the course of the investigation you  may want to access or export some of the key elements of the graph. This can easily be done with the `to_df` function.\n",
    "\n",
    "<div class=\"alert alert-block alert-info\">\n",
    "<b>Note:</b>  The EntityGraph is built on NetworkX. If you want to access the networkx object of the graph it can be accessed with `alertentity_graph`.\n",
    "</div>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Description</th>\n",
       "      <th>Type</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>EndTime</th>\n",
       "      <th>StartTime</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>Sample Incident</td>\n",
       "      <td>2021-09-22T15:09:09.2786667Z - Sample Incident - 123</td>\n",
       "      <td>incident</td>\n",
       "      <td>2021-09-22 15:09:09.278666700</td>\n",
       "      <td>2021-09-22T14:39:24.04Z</td>\n",
       "      <td>2021-09-22T14:39:24.04Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>User Added to Priviledged Group in CONTOSO Domain</td>\n",
       "      <td>User Added to Priviledged Group in CONTOSO Domain - ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5']</td>\n",
       "      <td>alert</td>\n",
       "      <td>NaT</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>CONTOSO\\auser</td>\n",
       "      <td>None</td>\n",
       "      <td>entity</td>\n",
       "      <td>NaT</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>www.contoso.com</td>\n",
       "      <td>www.contoso.com</td>\n",
       "      <td>entity</td>\n",
       "      <td>NaT</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>This is a note</td>\n",
       "      <td>Notes allow for free form additions to the graph</td>\n",
       "      <td>analystnote</td>\n",
       "      <td>2021-10-06 09:05:35.203699000</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                Name  \\\n",
       "0                                    Sample Incident   \n",
       "1  User Added to Priviledged Group in CONTOSO Domain   \n",
       "2                                      CONTOSO\\auser   \n",
       "3                                    www.contoso.com   \n",
       "4                                     This is a note   \n",
       "\n",
       "                                                                                    Description  \\\n",
       "0                                          2021-09-22T15:09:09.2786667Z - Sample Incident - 123   \n",
       "1  User Added to Priviledged Group in CONTOSO Domain - ['8b7d06d8-dbae-4b23-87ed-1a27b75437d5']   \n",
       "2                                                                                          None   \n",
       "3                                                                               www.contoso.com   \n",
       "4                                              Notes allow for free form additions to the graph   \n",
       "\n",
       "          Type                 TimeGenerated                  EndTime  \\\n",
       "0     incident 2021-09-22 15:09:09.278666700  2021-09-22T14:39:24.04Z   \n",
       "1        alert                           NaT                     None   \n",
       "2       entity                           NaT                     None   \n",
       "3       entity                           NaT                     None   \n",
       "4  analystnote 2021-10-06 09:05:35.203699000                     None   \n",
       "\n",
       "                 StartTime  \n",
       "0  2021-09-22T14:39:24.04Z  \n",
       "1                     None  \n",
       "2                     None  \n",
       "3                     None  \n",
       "4                     None  "
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "graph.to_df()"
   ]
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "70673dbb0e081aa3831869ef2042eea6ce08ea300fe5aabb70c669fac0ce2a09"
  },
  "kernelspec": {
   "display_name": "Python 3.8.10 64-bit ('dev38': conda)",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.7"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
